PspCreateSecureThread

INT64 __stdcall PspCreateSecureThread(PVOID Base, INT64 a2){
  UINT64 v4; 
  _MDL *PoolWithTag; 
  NTSTATUS v6; 
  KAPC_STATE ApcState; 
  memset(&ApcState, 0, sizeof(ApcState));
  KiStackAttachProcess(*((_KPROCESS **)Base + 68), 0i64, &ApcState);
  v4 = MmSizeOfMdl(Base, 0x898ui64);
  PoolWithTag = (_MDL *)ExAllocatePoolWithTag(NonPagedPoolNx, v4, 0x65537350ui64);
  PoolWithTag->Next = 0i64;
  PoolWithTag->Size = 8 * (((unsigned __int16)(((unsigned __int16)Base & 0xFFF) + 6295) >> 12) + 6);
  PoolWithTag->MdlFlags = 0;
  PoolWithTag->StartVa = (void *)((unsigned __int64)Base & 0xFFFFFFFFFFFFF000ui64);
  PoolWithTag->ByteOffset = (unsigned __int16)Base & 0xFFF;
  PoolWithTag->ByteCount = 2200;
  MmProbeAndLockPages(PoolWithTag, 0, IoModifyAccess);
  v6 = KeSecureThread((INT64)Base, (INT64)PoolWithTag, *((_QWORD *)Base + 144), *((_QWORD *)Base + 154), a2);
  if( v6 < 0 )
  {
    MmUnlockPages(PoolWithTag);
    ExFreePoolWithTag(PoolWithTag, 0x65537350u);
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  return(unsigned int)v6;
}

Referenced by: