PspSetupUserShadowStack

NTSTATUS __stdcall PspSetupUserShadowStack(_EPROCESS *Process, INT32 *rdx0, INT64 r8_0, _BYTE *r9_0, UINT64 a5){
  NTSTATUS result; 
  NTSTATUS v10; 
  char *ExtendedFeature; 
  UINT64 v12; 
  INT64 v13; 
  UINT64 v14; 
  INT64 v15; 
  UINT64 v16; 
  UINT64 v17; 
  _KAPC_STATE ApcState; 

  v15 = 0i64;
  v17 = 0i64;
  v14 = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  result = RtlCalculateUserShadowStackSizes(r8_0, &v14);
  if( result >= 0 )
  {
    KiStackAttachProcess(Process, 0i64, &ApcState);
    v16 = 0i64;
    v10 = PspReserveAndCommitUserShadowStack(v14, v17, a5, (INT64 *)&v16, &v15);
    if( v10 < 0 )
    {
      v12 = v16;
    }
    else
    {
      if( (rdx0[12] & 0x100040) == 1048640 )
      {
        ExtendedFeature = RtlLocateExtendedFeature(rdx0 + 308, 0xBu, 0i64);
        if( ExtendedFeature )
        {
          *(_QWORD *)((char *)rdx0 + rdx0[312] + 1232) |= 0x800ui64;
          *((_QWORD *)ExtendedFeature + 1) = v15;
          *(_QWORD *)ExtendedFeature = 1i64;
        }
      }
      *(_QWORD *)(r8_0 + 64) = v16;
      *r9_0 |= 8u;
      v12 = 0i64;
    }
    if( v12 )
    {
      v15 = 0i64;
      LODWORD(v13) = 0x40000000;
      v14 = v12;
      MmFreeVirtualMemory(-1i64, &v14, &v15, 0x8000i64, 0, v13);
    }
    KiUnstackDetachProcess(&ApcState, 0i64);
    return v10;
  }
  return result;
}

Referenced by: