KeUserModeCallback

NTSTATUS __stdcall KeUserModeCallback(
        UINT64 ApiNumber,
        PVOID InputBuffer,
        UINT64 InputLength,
        PVOID *OutputBuffer,
        UINT64 *OutputLength){
  __int64 v5; 
  _ETHREAD *CurrentThread; 
  char v7; 
  __int64 KernelStack; 
  char *v9; 
  __int64 v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  char v17; 
  NTSTATUS v18; 
  NTSTATUS v19; 
  unsigned __int64 v21; 
  ULONG_PTR retaddr; 
  int v23; 
  v23 = ApiNumber;
  v5 = (unsigned int)InputLength;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*((_DWORD *)CurrentThread + 29) & 0x1000) != 0 )
    KeBugCheckEx(0x107u, (ULONG_PTR)CurrentThread, 0i64, 0i64, 0i64);
  if( KeGetCurrentIrql() )
    KeBugCheckEx(0x4Au, retaddr, KeGetCurrentIrql(), 0i64, 0i64);
  if( *((_BYTE *)CurrentThread + 586) || *((_DWORD *)CurrentThread + 121) )
    KeBugCheckEx(1u, retaddr, *((unsigned __int8 *)CurrentThread + 586), *((unsigned int *)CurrentThread + 121), 0i64);
  v7 = *((_BYTE *)CurrentThread + 731);
  *((_BYTE *)CurrentThread + 731) = v7 + 1;
  if( (unsigned __int8)(v7 + 1) > 0x1Fu )
  {
    *((_BYTE *)CurrentThread + 731) = v7;
    return -1073741571;
  }
  else
  {
    KernelStack = MmCreateKernelStack(
                    0,
                    *(unsigned __int16 *)(*((_QWORD *)*(&KiProcessorBlock + *((unsigned int *)CurrentThread + 147)) + 24)
                                        + 146i64),
                    (unsigned __int64)CurrentThread);
    v9 = (char *)KernelStack;
    if( KernelStack )
    {
      *(_QWORD *)(KernelStack - 48) = KernelStack;
      *(_QWORD *)(KernelStack - 40) = KernelStack - (unsigned int)KeKernelStackSize;
      *(_QWORD *)(KernelStack - 32) = *((_QWORD *)CurrentThread + 7);
      *(_QWORD *)(KernelStack - 24) = *((_QWORD *)CurrentThread + 6);
      *(_QWORD *)(KernelStack - 8) = *((_QWORD *)CurrentThread + 5);
      v10 = *((_QWORD *)CurrentThread + 18);
      v11 = *(_QWORD *)(v10 + 384);
      v12 = (v11 - (((v5 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 88)) & 0xFFFFFFFFFFFFFFF0ui64;
      v13 = v12;
      v14 = v12 + ((v5 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 87;
      if( v12 > v14 || v14 >= 0x7FFFFFFF0000i64 )
        ExRaiseAccessViolation();
      v15 = (v14 & 0xFFFFFFFFFFFFF000ui64) + 4096;
      do
      {
        *(_BYTE *)v13 = *(_BYTE *)v13;
        v13 = (v13 & 0xFFFFFFFFFFFFF000ui64) + 4096;
      }
      while( v13 != v15 );
      memmove((UINT8 *)(v12 + 88), (UINT8 *)InputBuffer, (unsigned int)v5);
      *(_QWORD *)(v12 + 32) = v12 + 88;
      *(_DWORD *)(((v11 - (((v5 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 88)) & 0xFFFFFFFFFFFFFFF0ui64) + 0x28) = v5;
      *(_DWORD *)(((v11 - (((v5 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 88)) & 0xFFFFFFFFFFFFFFF0ui64) + 0x2C) = v23;
      *(_QWORD *)(((v11 - (((v5 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 88)) & 0xFFFFFFFFFFFFFFF0ui64) + 0x48) = v11;
      *(_QWORD *)(((v11 - (((v5 + 15) & 0xFFFFFFFFFFFFFFF0ui64) + 88)) & 0xFFFFFFFFFFFFFFF0ui64) + 0x30) = *(_QWORD *)(v10 + 360);
      v16 = 0i64;
      if( (*((_DWORD *)CurrentThread + 29) & 0x100000) != 0 )
      {
        v21 = __readmsr(0x6A0u);
        if( (v21 & 1) != 0 )
          v16 = __readmsr(0x6A7u);
      }
      v17 = *((_BYTE *)KeGetPcr() + 2131);
      *(_QWORD *)(v10 + 384) = v12;
      KiCallUserMode(OutputBuffer, OutputLength, v9 - 48, v9);
      v19 = v18;
      if( (v17 & 1) != 0 )
        KeExitRetpoline();
      _mm_lfence();
      if( *(_DWORD *)(*((_QWORD *)CurrentThread + 30) + 5952i64) )
      {
        *(_QWORD *)(v10 + 384) -= 256i64;
        PsInvokeWin32Callout(7i64, 0i64, 0i64, 0i64);
      }
      if( v16 )
        __writemsr(0x6A7u, v16);
      *(_QWORD *)(v10 + 384) = v11;
      --*((_BYTE *)CurrentThread + 731);
      MmDeleteKernelStack(v9, 0i64);
      return v19;
    }
    else
    {
      --*((_BYTE *)CurrentThread + 731);
      return -1073741801;
    }
  }
}

Referenced by: