PspGetContext

INT64 __fastcall PspGetContext(_DEVICE_OBJECT *DeviceObject){
  _QWORD **v1; 
  INT64 v2; 
  int v3; 
  INT64 v5; 
  _QWORD *v6; 
  __int64 v7; 
  INT64 result; 
  char v9; 
  __int64 v10; 
  _QWORD *v11; 
  INT64 v12; 
  _QWORD *v13; 
  _QWORD *v14; 
  v3 = *(_DWORD *)(v2 + 48);
  v5 = v2;
  v6 = v1;
  if( (v3 & 0x100001) == 1048577 )
  {
    *(_QWORD *)(v2 + 248) = *((_QWORD *)DeviceObject + 45);
    *(_WORD *)(v2 + 56) = *((_WORD *)DeviceObject + 184);
    *(_WORD *)(v2 + 66) = *((_WORD *)DeviceObject + 196);
    *(_QWORD *)(v2 + 152) = *((_QWORD *)DeviceObject + 48);
    *(_DWORD *)(v2 + 68) = *((_DWORD *)DeviceObject + 94);
  }
  if( (v3 & 0x100004) == 1048580 )
  {
    *(_DWORD *)(v2 + 58) = 2818091;
    *(_DWORD *)(v2 + 62) = 2818131;
  }
  if( (v3 & 0x100002) == 1048578 )
  {
    *(_QWORD *)(v2 + 120) = *((_QWORD *)DeviceObject + 6);
    *(_QWORD *)(v2 + 128) = *((_QWORD *)DeviceObject + 7);
    *(_QWORD *)(v2 + 136) = *((_QWORD *)DeviceObject + 8);
    *(_QWORD *)(v2 + 184) = *((_QWORD *)DeviceObject + 9);
    *(_QWORD *)(v2 + 192) = *((_QWORD *)DeviceObject + 10);
    *(_QWORD *)(v2 + 200) = *((_QWORD *)DeviceObject + 11);
    *(_QWORD *)(v2 + 208) = *((_QWORD *)DeviceObject + 12);
    *(_QWORD *)(v2 + 144) = *v1[19];
    *(_QWORD *)(v2 + 160) = *v1[21];
    *(_QWORD *)(v2 + 168) = *v1[22];
    *(_QWORD *)(v2 + 176) = *v1[23];
    *(_QWORD *)(v2 + 216) = *v1[28];
    *(_QWORD *)(v2 + 224) = *v1[29];
    *(_QWORD *)(v2 + 232) = *v1[30];
    *(_QWORD *)(v2 + 240) = *v1[31];
  }
  v7 = 0i64;
  if( (v3 & 0x100040) == 1048640 )
  {
    if( (*((_BYTE *)DeviceObject + 368) & 1) != 0 )
    {
      v10 = *(int *)(v2 + 1248);
      v11 = (_QWORD *)*((_QWORD *)KeGetCurrentThread() + 51);
      if( v11 )
      {
        v14 = (_QWORD *)*v11;
        if( *v11 )
        {
          do
          {
            v11 = v14;
            v14 = (_QWORD *)*v14;
          }
          while( v14 );
        }
        v12 = v11[5];
      }
      else
      {
        v12 = 0i64;
      }
      v13 = (_QWORD *)(v5 + v10 + 720);
      if( v12 )
        KiCopyXStateArea((INT64)v13, KUSER_SHARED_DATA.XState.EnabledFeatures & 0xFFFFFFFFFFFFFFFCui64, v12);
      else
        RtlXSaveS(
          v13,
          (KUSER_SHARED_DATA.XState.EnabledFeatures | KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures) & 0xFFFFFFFFFFFFFFFCui64);
    }
    *(_DWORD *)(v5 + 52) = *((_DWORD *)DeviceObject + 11);
    *(_DWORD *)(v5 + 280) = *((_DWORD *)DeviceObject + 11);
  }
  if( (v3 & 0x100008) == 1048584 )
  {
    *(_OWORD *)(v5 + 416) = *((_OWORD *)DeviceObject + 7);
    *(_OWORD *)(v5 + 432) = *((_OWORD *)DeviceObject + 8);
    *(_OWORD *)(v5 + 448) = *((_OWORD *)DeviceObject + 9);
    *(_OWORD *)(v5 + 464) = *((_OWORD *)DeviceObject + 10);
    *(_OWORD *)(v5 + 480) = *((_OWORD *)DeviceObject + 11);
    *(_OWORD *)(v5 + 496) = *((_OWORD *)DeviceObject + 12);
    *(_OWORD *)(v5 + 512) = *(_OWORD *)v6[6];
    *(_OWORD *)(v5 + 528) = *(_OWORD *)v6[7];
    *(_OWORD *)(v5 + 544) = *(_OWORD *)v6[8];
    *(_OWORD *)(v5 + 560) = *(_OWORD *)v6[9];
    *(_OWORD *)(v5 + 576) = *(_OWORD *)v6[10];
    *(_OWORD *)(v5 + 592) = *(_OWORD *)v6[11];
    *(_OWORD *)(v5 + 608) = *(_OWORD *)v6[12];
    *(_OWORD *)(v5 + 624) = *(_OWORD *)v6[13];
    *(_OWORD *)(v5 + 640) = *(_OWORD *)v6[14];
    *(_OWORD *)(v5 + 656) = *(_OWORD *)v6[15];
    *(_DWORD *)(v5 + 52) = *((_DWORD *)DeviceObject + 11);
    *(_DWORD *)(v5 + 280) = *((_DWORD *)DeviceObject + 11);
  }
  result = v3 & 0x100010;
  if( (_DWORD)result == 1048592 )
  {
    if( (*((_DWORD *)DeviceObject + 64) & 0x355i64) != 0 )
    {
      *(_QWORD *)(v5 + 72) = *((_QWORD *)DeviceObject + 27);
      *(_QWORD *)(v5 + 80) = *((_QWORD *)DeviceObject + 28);
      *(_QWORD *)(v5 + 88) = *((_QWORD *)DeviceObject + 29);
      *(_QWORD *)(v5 + 96) = *((_QWORD *)DeviceObject + 30);
      *(_QWORD *)(v5 + 104) = *((_QWORD *)DeviceObject + 31);
      v7 = *((_QWORD *)DeviceObject + 32);
    }
    else
    {
      *(_QWORD *)(v5 + 72) = 0i64;
      *(_QWORD *)(v5 + 80) = 0i64;
      *(_QWORD *)(v5 + 88) = 0i64;
      *(_QWORD *)(v5 + 96) = 0i64;
      *(_QWORD *)(v5 + 104) = 0i64;
    }
    *(_QWORD *)(v5 + 112) = v7;
    result = KeCopyLastBranchInformation(v5, (INT64)DeviceObject);
  }
  if( (v3 & 0x40000000) != 0 )
  {
    result = *(_DWORD *)(v5 + 48) & 0xE7FFFFFF;
    LODWORD(result) = *(_DWORD *)(v5 + 48) & 0x67FFFFFF | 0x80000000;
    *(_DWORD *)(v5 + 48) = result;
    v9 = *((_BYTE *)DeviceObject + 43);
    if( v9 == 1 )
    {
      LODWORD(result) = result | 0x8000000;
    }
    else
    {
      if( v9 != 2 )
        return result;
      LODWORD(result) = result | 0x10000000;
    }
    *(_DWORD *)(v5 + 48) = result;
  }
  return result;
}

Referenced by: