MmCreateTeb

__int64 __fastcall MmCreateTeb(ULONG_PTR BugCheckParameter1, __int64 a2, _QWORD *a3, __int64 a4, __int64 a5){
  unsigned int v9; 
  __int64 v10; 
  __int64 *v11; 
  NTSTATUS PebOrTeb; 
  __int16 v14; 
  _KAPC_STATE ApcState; 
  memset(&ApcState, 0, sizeof(ApcState));
  v9 = 3;
  v10 = 0i64;
  v11 = *(__int64 **)(BugCheckParameter1 + 1408);
  if( v11 )
    v10 = *v11;
  if( v10 )
  {
    if( v11 && ((v14 = *((_WORD *)v11 + 4), v14 == 332) || v14 == 452) )
      v9 = 4;
    else
      v9 = 5;
  }
  KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
  PebOrTeb = MiCreatePebOrTeb(v9, (PVOID *)a4);
  if( PebOrTeb < 0 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
    return(unsigned int)PebOrTeb;
  }
  MEMORY[0x20] = 7680;
  MEMORY[0x30] = 0i64;
  MEMORY[0x48] = a3[1];
  MEMORY[0x40] = *a3;
  MEMORY[0x2E8] = 65534;
  MEMORY[0x7E0] = a3[1];
  MEMORY[0x7D8] = *a3;
  MEMORY[0x125A] = 522;
  MEMORY[0x1260] = 4712i64;
  MEMORY[0x60] = *(_QWORD *)(BugCheckParameter1 + 1360);
  MEMORY[8] = *(_QWORD *)(a2 + 16);
  MEMORY[0x10] = *(_QWORD *)(a2 + 24);
  MEMORY[0x1478] = *(_QWORD *)(a2 + 32);
  MEMORY[0x1750] = BBTBuffer;
  if( v9 == 4 )
  {
    MEMORY[0x2010] = 7680;
    MEMORY[0x2018] = 0x2000;
    MEMORY[0x2024] = *((_DWORD *)a3 + 2);
    MEMORY[0x2020] = *(_DWORD *)a3;
    MEMORY[0x21D0] = 65534;
    MEMORY[0x26B8] = *((_DWORD *)a3 + 2);
    MEMORY[0x26B4] = *(_DWORD *)a3;
    MEMORY[0x2BFA] = 522;
    MEMORY[0x2BFC] = 11264;
    MEMORY[0x2000] = -1;
    MEMORY[0x2030] = v10;
    MEMORY[0x2F70] = 0;
    MEMORY[0x2F18] = MEMORY[0x1690];
    MEMORY[0x2004] = *(_DWORD *)(a2 + 40);
    MEMORY[0x2008] = *(_DWORD *)(a2 + 48);
    MEMORY[0x2E0C] = *(_DWORD *)(a2 + 56);
    MEMORY[0x180C] = 0x2000;
    MEMORY[0x2FDC] = -8192;
    goto LABEL_9;
  }
  if( v9 == 5 )
  {
    MEMORY[0x2020] = 7680;
    MEMORY[0x2030] = 0x2000i64;
    MEMORY[0x2048] = a3[1];
    MEMORY[0x2040] = *a3;
    MEMORY[0x22E8] = 65534;
    MEMORY[0x27E0] = a3[1];
    MEMORY[0x27D8] = *a3;
    MEMORY[0x325A] = 522;
    MEMORY[0x3260] = 12904i64;
    MEMORY[0x2060] = v10;
    MEMORY[0x3740] = 0;
    MEMORY[0x3690] = MEMORY[0x1690];
    MEMORY[0x2008] = *(_QWORD *)(a2 + 40);
    MEMORY[0x2010] = *(_QWORD *)(a2 + 48);
    MEMORY[0x3478] = *(_QWORD *)(a2 + 56);
    MEMORY[0x180C] = 0x2000;
    MEMORY[0x380C] = -8192;
LABEL_9:
    MEMORY[0] = 0x2000i64;
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  *(_QWORD *)a5 = 0i64;
  return(unsigned int)PebOrTeb;
}

Referenced by: