MmCreateTeb

__int64 __fastcall MmCreateTeb(PVOID Process, __int64 a2, _QWORD *a3, VOID **a4, __int64 a5){
  unsigned int v9; 
  __int64 v10; 
  __int64 *v11; 
  NTSTATUS v12; 
  _QWORD *v13; 
  char *v14; 
  __int16 v16; 
  VOID *Base; 
  _QWORD *v18; 
  __int64 v19; 
  _KAPC_STATE ApcState; 

  v18 = Process;
  v19 = a5;
  Base = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v9 = 3;
  v10 = 0i64;
  v11 = (__int64 *)*((_QWORD *)Process + 176);
  if( v11 )
    v10 = *v11;
  if( v10 )
  {
    if( v11 && ((v16 = *((_WORD *)v11 + 4), v16 == 332) || v16 == 452) )
      v9 = 4;
    else
      v9 = 5;
  }
  KiStackAttachProcess(Process, 0i64, &ApcState);
  v12 = MiCreatePebOrTeb(v9, a4, &Base);
  if( v12 < 0 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
    return(unsigned int)v12;
  }
  v13 = Base;
  *((_DWORD *)Base + 8) = 7680;
  v13[6] = v13;
  v13[9] = a3[1];
  v13[8] = *a3;
  *((_DWORD *)v13 + 186) = 65534;
  v13[252] = a3[1];
  v13[251] = *a3;
  *((_WORD *)v13 + 2349) = 522;
  v13[588] = v13 + 589;
  v13[12] = v18[170];
  v13[1] = *(_QWORD *)(a2 + 16);
  v13[2] = *(_QWORD *)(a2 + 24);
  v13[655] = *(_QWORD *)(a2 + 32);
  v13[746] = BBTBuffer;
  if( v9 == 4 )
  {
    v14 = (char *)(v13 + 1024);
    v18 = v13 + 1024;
    *((_DWORD *)v13 + 2052) = 7680;
    *((_DWORD *)v13 + 2054) = (_DWORD)v13 + 0x2000;
    *((_DWORD *)v13 + 2057) = *((_DWORD *)a3 + 2);
    *((_DWORD *)v13 + 2056) = *(_DWORD *)a3;
    *((_DWORD *)v13 + 2164) = 65534;
    *((_DWORD *)v13 + 2478) = *((_DWORD *)a3 + 2);
    *((_DWORD *)v13 + 2477) = *(_DWORD *)a3;
    *((_WORD *)v13 + 5629) = 522;
    *((_DWORD *)v13 + 2815) = (_DWORD)v13 + 11264;
    *((_DWORD *)v13 + 2048) = -1;
    *((_DWORD *)v13 + 2060) = v10;
    *((_DWORD *)v13 + 3036) = (_DWORD)v13;
    *((_DWORD *)v13 + 3014) = *((_DWORD *)v13 + 1444);
    *((_DWORD *)v13 + 2049) = *(_DWORD *)(a2 + 40);
    *((_DWORD *)v13 + 2050) = *(_DWORD *)(a2 + 48);
    *((_DWORD *)v13 + 2947) = *(_DWORD *)(a2 + 56);
    *((_DWORD *)v13 + 1539) = 0x2000;
    *((_DWORD *)v13 + 3063) = -8192;
    goto LABEL_9;
  }
  if( v9 == 5 )
  {
    v14 = (char *)(v13 + 1024);
    *((_DWORD *)v13 + 2056) = 7680;
    v13[1030] = v13 + 1024;
    v13[1033] = a3[1];
    v13[1032] = *a3;
    *((_DWORD *)v13 + 2234) = 65534;
    v13[1276] = a3[1];
    v13[1275] = *a3;
    *((_WORD *)v13 + 6445) = 522;
    v13[1612] = v13 + 1613;
    v13[1036] = v10;
    *((_DWORD *)v13 + 3536) = 0;
    v13[1746] = v13[722];
    v13[1025] = *(_QWORD *)(a2 + 40);
    v13[1026] = *(_QWORD *)(a2 + 48);
    v13[1679] = *(_QWORD *)(a2 + 56);
    *((_DWORD *)v13 + 1539) = 0x2000;
    *((_DWORD *)v13 + 3587) = -8192;
LABEL_9:
    *v13 = v14;
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  *(_QWORD *)a5 = v13;
  return(unsigned int)v12;
}

Referenced by: