KyStartUserThread

VOID __fastcall KyStartUserThread(INT64 SecurityDomain, INT64 BpbState, INT64 a3, INT64 a4){
  _ETHREAD *CurrentThread; 
  unsigned __int8 v5; 
  CHAR v6; 
  char v7; 
  __int16 v8; 
  if( (v7 & 1) != 0 )
  {
    if( (KiKvaShadow & 1) == 0 )
      __swapgs();
    _mm_lfence();
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    SecurityDomain = *(_QWORD *)(*((_QWORD *)CurrentThread + 68) + 2528i64);
    __writegsqword(0x270u, SecurityDomain);
    __writegsbyte(0x851u, *((_BYTE *)KeGetPcr() + 2128));
    LOBYTE(SecurityDomain) = *((_BYTE *)KeGetPcr() + 632);
    __writegsbyte(0x852u, SecurityDomain);
    v5 = *((_BYTE *)KeGetPcr() + 635);
    if( *((_BYTE *)KeGetPcr() + 634) != v5 )
    {
      __writegsbyte(0x27Au, v5);
      SecurityDomain = 72i64;
      HIDWORD(BpbState) = 0;
      __writemsr(0x48u, v5);
    }
    LODWORD(BpbState) = *((unsigned __int8 *)KeGetPcr() + 632);
    if( (BpbState & 8) != 0 )
    {
      SecurityDomain = 73i64;
      __writemsr(0x49u, 1ui64);
      BpbState = *((unsigned __int8 *)KeGetPcr() + 632);
      LODWORD(BpbState) = (unsigned __int8)BpbState;
    }
    if( (BpbState & 2) != 0 )
      __flush_rsb();
    _mm_lfence();
    __writegsbyte(0x853u, 0);
    if( (*((_BYTE *)CurrentThread + 3) & 3) != 0 )
      KiSaveDebugRegisterState();
  }
  else
  {
    _mm_lfence();
    if( (*((_BYTE *)KeGetPcr() + 632) & 1) != 0 )
    {
      SecurityDomain = 72i64;
      BpbState = 0i64;
      __writemsr(0x48u, *((unsigned __int8 *)KeGetPcr() + 634));
    }
    else
    {
      _mm_lfence();
    }
  }
  _mm_getcsr();
  _mm_setcsr(*((_DWORD *)KeGetPcr() + 96));
  if( (_BYTE)KeSmapEnabled && (v7 & 1) != 0 )
    __stac();
  if( (v8 & 0x200) != 0 )
    _enable();
  KxStartUserThread(SecurityDomain, BpbState, a3, a4, v6);
}

Referenced by: