KiSwitchKernelStackAndCallout
void __fastcall KiSwitchKernelStackAndCallout(
__int64 a1,
void (*a2)(void),
__int64 a3,
__int64 a4,
int a5,
int a6,
__int64 a7){
char v7;
unsigned __int64 v8;
_ETHREAD *CurrentThread;
unsigned __int64 v10;
unsigned __int64 v11;
__int64 v12;
_BYTE v13[24];
v7 = a3;
v8 = a3 & 0xFFFFFFFFFFFFFFFCui64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v10 = v8 + 48;
*(_QWORD *)(v8 + 32) = v13;
v11 = v8 - 80;
*(_QWORD *)(v11 + 40) = &KiSwitchKernelStackContinue;
*(_QWORD *)(v11 + 64) = v13;
_disable();
*(_QWORD *)(v8 + 24) = *((_QWORD *)CurrentThread + 6);
*((_QWORD *)CurrentThread + 5) = v8;
__writegsqword(0x1A8u, v8);
*((_QWORD *)CurrentThread + 7) = v8 + 48;
v12 = 24576i64;
if( (v7 & 2) != 0 )
v12 = 73728i64;
if( (v7 & 1) == 0 )
v12 = (unsigned int)KeKernelStackSize;
*((_QWORD *)CurrentThread + 6) = v10 - v12;
KxSwitchKernelStackCallout(a1, a2, v12, a4, a5, a6, a7);
}Referenced by:
KiExpandKernelStackAndCalloutOnStackSegment