PspShutdownCsrProcess

__int64 __fastcall PspShutdownCsrProcess(__int64 a1, unsigned int a2, ULONG_PTR a3){
  _EJOB *v4; 
  WCHAR v5; 
  WCHAR v6; 
  NTSTATUS v7; 
  HANDLE v8; 
  int v9; 
  HANDLE v10; 
  __int64 result; 
  HANDLE Handle; 
  void *EventHandle; 
  UINT64 v14; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  _KAPC_STATE ApcState; 
  wchar_t pszDest[120]; 
  LODWORD(v14) = a2;
  memset(&ApcState, 0, sizeof(ApcState));
  Handle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  EventHandle = 0i64;
  v4 = PsAttachSiloToCurrentThread((_EJOB *)a1);
  RtlStringCchPrintfW(pszDest, 0x78ui64, (WCHAR *)&stru_1407D6010.MxCsr);
  RtlInitUnicodeString(&DestinationString, pszDest, v5);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ZwOpenEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes);
  RtlStringCchPrintfW(pszDest, 0x78ui64, (WCHAR *)&stru_1407D6010.Xmm12);
  RtlInitUnicodeString(&DestinationString, pszDest, v6);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 704;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v7 = ZwCreateEvent(&Handle, 0x1F0003ui64, &ObjectAttributes, NotificationEvent, 0);
  v8 = Handle;
  if( v7 < 0 )
    v8 = 0i64;
  Handle = v8;
  PsDetachSiloFromCurrentThread(v4);
  KiStackAttachProcess((_KPROCESS *)a3, 0i64, &ApcState);
  v9 = PsInvokeWin32Callout(31i64, 0i64, 1i64, &v14);
  KiUnstackDetachProcess(&ApcState, 0i64);
  if( EventHandle )
  {
    ZwSetEvent(EventHandle, 0i64);
    ZwClose(EventHandle);
    EventHandle = 0i64;
  }
  v10 = Handle;
  if( Handle )
  {
    if( v9 >= 0 )
    {
      ZwWaitForSingleObject(Handle, 0, 0i64);
      v10 = Handle;
    }
    ZwClose(v10);
    Handle = 0i64;
  }
  result = PsTerminateProcess(a3, 0xC00002EB);
  if( (int)result >= 0 )
    return PspWaitForUsermodeExit((PEPROCESS)a3);
  return result;
}

Referenced by: