KiCallUserMode

VOID __stdcall KiCallUserMode(PVOID *OutputBuffer, UINT64 *OutputLength, PVOID NewInitialStack, PVOID NewStackBase){
  __int64 v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  __int128 v12; 
  __int128 v13; 
  __int128 v14; 
  __int128 v15; 
  __int128 v16; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 
  __int128 v20; 
  __int128 v21; 
  _ETHREAD *CurrentThread; 
  char *v23; 
  char *v24; 
  char *v25; 
  void *v26; 
  unsigned __int8 v27; 
  unsigned __int8 v28; 
  _KTRAP_FRAME *__shifted(_KTRAP_FRAME,0x80) TrapFrame; 
  __int64 v32; 
  __int128 v33; 
  __int128 v34; 
  __int128 v35; 
  __int128 v36; 
  __int128 v37; 
  __int128 v38; 
  __int128 v39; 
  __int128 v40; 
  __int128 v41; 
  __int128 v42; 
  char *v43; 
  PVOID *v44; 
  UINT64 *v45; 
  __int64 v46; 
  __int64 v47; 
  __int64 v48; 
  __int64 v49; 
  __int64 v50; 
  __int64 v51; 
  __int64 v52; 
  __int64 v53; 
  void *retaddr; 
  v33 = v12;
  v34 = v13;
  v35 = v14;
  v36 = v15;
  v37 = v16;
  v38 = v17;
  v39 = v18;
  v40 = v19;
  v41 = v20;
  v42 = v21;
  v46 = v5;
  v47 = v4;
  v48 = v6;
  v49 = v7;
  v50 = v8;
  v51 = v9;
  v52 = v10;
  v53 = v11;
  v44 = OutputBuffer;
  v45 = OutputLength;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *((_QWORD *)NewInitialStack + 4) = &v32;
  v23 = (char *)*((_QWORD *)CurrentThread + 18);
  v43 = v23;
  _disable();
  *((_QWORD *)CurrentThread + 5) = NewInitialStack;
  *((_QWORD *)CurrentThread + 7) = NewStackBase;
  if( (KiKvaShadow & 1) != 0 )
    __writegsqword(0x9008u, (unsigned __int64)NewInitialStack);
  else
    *(_QWORD *)(*((_QWORD *)KeGetPcr() + 1) + 4i64) = NewInitialStack;
  v24 = (char *)NewStackBase - (unsigned int)KeKernelStackSize;
  __writegsqword(0x1A8u, (unsigned __int64)NewInitialStack);
  *((_QWORD *)CurrentThread + 6) = v24;
  qmemcpy(&retaddr, v23, 0x190ui64);
  v25 = v23 + 400;
  if( (*((_BYTE *)CurrentThread + 194) & 3) != 0
    || (*(_DWORD *)CurrentThread & 0x48010000) != 0
    || (*((_BYTE *)KeGetPcr() + 638) & 2) != 0 )
  {
    TrapFrame = KeGetTrapFrame();
    ADJ(TrapFrame)->SegCs = 51;
    ADJ(TrapFrame)->Rip = (unsigned __int64)KeUserCallbackDispatcher;
    JUMPOUT(0x14040D900i64);
  }
  _mm_setcsr(*((_DWORD *)v25 - 89));
  if( (*((_BYTE *)CurrentThread + 3) & 3) != 0 )
  {
    KiRestoreDebugRegisterState();
    v26 = *(void **)(*((_QWORD *)CurrentThread + 23) + 984i64);
    if( !v26 )
      v26 = KeUserCallbackDispatcher;
  }
  else
  {
    v26 = KeUserCallbackDispatcher;
  }
  __writegsbyte(0x853u, 0);
  v27 = *((_BYTE *)KeGetPcr() + 637);
  if( *((_BYTE *)KeGetPcr() + 634) != v27 )
  {
    __writegsbyte(0x27Au, v27);
    __writemsr(0x48u, v27);
  }
  v28 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
  if( v28 )
    __writemsr(0x49u, 1ui64);
  v28 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
  if( v28 )
    __flush_rsb();
  if( (KiKvaShadow & 1) == 0 )
  {
    __swapgs();
    __sysretq(v26, *((_QWORD *)v25 - 3));
  }
  KiKernelSysretExit(v26);
}

Referenced by: