KiCallUserMode

VOID __fastcall KiCallUserMode(VOID **OutputBuffer, UINT64 *OutputLength, VOID *NewInitialStack, VOID *NewStackBase){
  __int64 v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  __int128 v12; 
  __int128 v13; 
  __int128 v14; 
  __int128 v15; 
  __int128 v16; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 
  __int128 v20; 
  __int128 v21; 
  _ETHREAD *CurrentThread; 
  _KTRAP_FRAME *TrapFrame; 
  char *v24; 
  _KTRAP_FRAME *v25; 
  void *InstrumentationCallback; 
  unsigned __int8 BpbUserSpecCtrl; 
  unsigned __int8 v28; 
  _KTRAP_FRAME *__shifted(_KTRAP_FRAME,0x80) v31; 
  __int64 v32; 
  __int128 v33; 
  __int128 v34; 
  __int128 v35; 
  __int128 v36; 
  __int128 v37; 
  __int128 v38; 
  __int128 v39; 
  __int128 v40; 
  __int128 v41; 
  __int128 v42; 
  _KTRAP_FRAME *v43; 
  VOID **v44; 
  UINT64 *v45; 
  __int64 v46; 
  __int64 v47; 
  __int64 v48; 
  __int64 v49; 
  __int64 v50; 
  __int64 v51; 
  __int64 v52; 
  __int64 v53; 
  void *retaddr; 

  v33 = v12;
  v34 = v13;
  v35 = v14;
  v36 = v15;
  v37 = v16;
  v38 = v17;
  v39 = v18;
  v40 = v19;
  v41 = v20;
  v42 = v21;
  v46 = v5;
  v47 = v4;
  v48 = v6;
  v49 = v7;
  v50 = v8;
  v51 = v9;
  v52 = v10;
  v53 = v11;
  v44 = OutputBuffer;
  v45 = OutputLength;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *((_QWORD *)NewInitialStack + 4) = &v32;
  TrapFrame = CurrentThread->Tcb.TrapFrame;
  v43 = TrapFrame;
  _disable();
  CurrentThread->Tcb.InitialStack = NewInitialStack;
  CurrentThread->Tcb.StackBase = NewStackBase;
  if( (KiKvaShadow & 1) != 0 )
    __writegsqword(0x9008u, (unsigned __int64)NewInitialStack);
  else
    *(_QWORD *)((char *)KeGetPcr()->NtTib.StackBase + 4) = NewInitialStack;
  v24 = (char *)NewStackBase - (unsigned int)KeKernelStackSize;
  __writegsqword(0x1A8u, (unsigned __int64)NewInitialStack);
  CurrentThread->Tcb.StackLimit = v24;
  qmemcpy(&retaddr, TrapFrame, 0x190ui64);
  v25 = TrapFrame + 1;
  if( (CurrentThread->Tcb.ApcState.UserApcPendingAll & 3) != 0
    || (*(_DWORD *)CurrentThread->Tcb.gap0 & 0x48010000) != 0
    || (*((_BYTE *)&KeGetPcr()->Prcb.2 + 14) & 2) != 0 )
  {
    v31 = KeGetTrapFrame();
    ADJ(v31)->SegCs = 51;
    ADJ(v31)->_Rip = (unsigned __int64)KeUserCallbackDispatcher;
    JUMPOUT(0x14040D900i64);
  }
  _mm_setcsr(v25[-1]._MxCsr);
  if( (CurrentThread->Tcb.gap0[3] & 3) != 0 )
  {
    KiRestoreDebugRegisterState();
    InstrumentationCallback = CurrentThread->Tcb.ApcState.Process->Pcb.InstrumentationCallback;
    if( !InstrumentationCallback )
      InstrumentationCallback = KeUserCallbackDispatcher;
  }
  else
  {
    InstrumentationCallback = KeUserCallbackDispatcher;
  }
  __writegsbyte(0x853u, 0);
  BpbUserSpecCtrl = KeGetPcr()->Prcb.BpbUserSpecCtrl;
  if( KeGetPcr()->Prcb.BpbCurrentSpecCtrl != BpbUserSpecCtrl )
  {
    __writegsbyte(0x27Au, BpbUserSpecCtrl);
    __writemsr(0x48u, BpbUserSpecCtrl);
  }
  v28 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
  if( v28 )
    __writemsr(0x49u, 1ui64);
  v28 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
  if( v28 )
    __flush_rsb();
  if( (KiKvaShadow & 1) == 0 )
  {
    __swapgs();
    __sysretq(InstrumentationCallback, *(_QWORD *)&v25[-1].EFlags);
  }
  KiKernelSysretExit(InstrumentationCallback);
}

Referenced by: