KxStartUserThread

VOID __fastcall KxStartUserThread(INT64 a1, INT64 a2, INT64 a3, INT64 a4, CHAR a5){
  __int64 v5; 
  INT64 v6; 
  INT64 v7; 
  INT64 v8; 
  _ETHREAD *CurrentThread; 
  _KTHREAD *v10; 
  INT64 v11; 
  INT64 v12; 
  unsigned __int8 v13; 
  unsigned __int8 v14; 
  __int64 v17; 
  __int64 v18; 
  void(__fastcall *v19)(_QWORD, _QWORD, _QWORD, _QWORD); 
  CHAR v20; 
  void *retaddr; 
  __int16 v22; 
  int v23; 
  void *v24; 
  __int16 v25; 
  if( (_BYTE)KeSmapEnabled )
    __stac();
  __writecr8(1ui64);
  v19(v18, v17, a3, a4);
  _disable();
  if( (*(_BYTE *)(v5 + 240) & 1) == 0 )
  {
    _mm_setcsr(*(_DWORD *)(v5 - 84));
    __iretq(retaddr, v22, v23, v24, v25);
  }
  if( (_BYTE)KeSmapEnabled )
    __stac();
  while( (*((_BYTE *)KeGetCurrentThread() + 194) & 3) != 0 )
  {
    __writecr8(1ui64);
    _enable();
    KiInitiateUserApc((_KTRAP_FRAME *)1);
    _disable();
    __writecr8(0i64);
  }
  if( (*((_BYTE *)KeGetPcr() + 638) & 2) != 0 )
    KiUpdateStibpPairing(0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_DWORD *)CurrentThread & 0x8000000) != 0 )
    KiRestoreSetContextState((INT64)CurrentThread, v6, v7, v8, v20);
  v10 = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_DWORD *)v10 & 0x40010000) != 0 )
  {
    if( (*((_BYTE *)v10 + 2) & 1) != 0 )
    {
      KiCopyCounters((_KTHREAD *)v10);
      v10 = (_ETHREAD *)KeGetCurrentThread();
    }
    if( (*((_BYTE *)v10 + 3) & 0x40) != 0 )
      KiUmsExit(1);
  }
  _mm_setcsr(*(_DWORD *)(v5 - 84));
  if( *(_WORD *)(v5 + 128) )
    KiRestoreDebugRegisterState();
  v11 = *(_QWORD *)(v5 - 48);
  v12 = *(_QWORD *)(v5 - 56);
  __writegsbyte(0x853u, 0);
  v13 = *((_BYTE *)KeGetPcr() + 637);
  if( *((_BYTE *)KeGetPcr() + 634) != v13 )
  {
    __writegsbyte(0x27Au, v13);
    __writemsr(0x48u, v13);
  }
  v14 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
  if( v14 )
    __writemsr(0x49u, 1ui64);
  v14 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
  if( v14 )
    __flush_rsb();
  if( (KiKvaShadow & 1) == 0 )
  {
    __swapgs();
    __iretq(retaddr, v22, v23, v24, v25);
  }
  KiKernelExit(*(_QWORD *)(v5 - 72), *(_QWORD *)(v5 - 64), v12, v11, a5);
}

Referenced by: