PspSetupUserStack

__int64 __fastcall PspSetupUserStack(ULONG_PTR a1, __int64 a2, __int64 a3, char *a4, unsigned int a5){
  char v5; 
  char v6; 
  unsigned __int64 v11; 
  int UserStack; 
  __int64 v13; 
  UINT64 v15; 
  ULONG_PTR RegionSize; 
  PVOID BaseAddress; 
  _KAPC_STATE ApcState; 
  v5 = *a4;
  v6 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  if( (v5 & 1) != 0 )
    goto LABEL_9;
  v11 = 4096i64;
  if( a5 )
    v11 = ((unsigned __int64)a5 << 56) | 0x1000;
  KiStackAttachProcess((_KPROCESS *)a1, 0i64, &ApcState);
  UserStack = RtlCreateUserStack(
                *((_QWORD *)a4 + 2),
                *((_QWORD *)a4 + 3),
                *((_QWORD *)a4 + 1),
                v11,
                v15,
                (_INITIAL_TEB *)a3);
  if( UserStack < 0 )
    goto LABEL_13;
  if( (*(_DWORD *)(a1 + 2512) & 0x40) != 0 )
    v13 = 0i64;
  else
    v13 = 16 * (unsigned int)(ExGenRandom(1i64) & 0x7F);
  if( !*(_QWORD *)(a1 + 1408) || (UserStack = PspWow64SetupCpuArea((UINT64 *)(a3 + 16), a1), UserStack >= 0) )
  {
    *(_QWORD *)(a2 + 152) = *(_QWORD *)(a3 + 16) - v13 - 40;
    KiUnstackDetachProcess(&ApcState, 0i64);
    v5 = *a4;
    v6 = 2;
LABEL_9:
    *a4 = v6 | v5 & 0xFD;
    return 0i64;
  }
  BaseAddress = *(PVOID *)(a3 + 32);
  RegionSize = 0i64;
  ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, &RegionSize, 0x8000ui64);
LABEL_13:
  KiUnstackDetachProcess(&ApcState, 0i64);
  return(unsigned int)UserStack;
}

Referenced by: