PspCaptureCreateInfo

NTSTATUS __stdcall PspCaptureCreateInfo(
        INT8 PreviousMode,
        PS_CREATE_INFO *CreateInfo,
        PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  NTSTATUS v4; 
  __int64 v5; 
  char v6; 
  char v7; 

  v4 = 0;
  if( PreviousMode )
  {
    if( ((unsigned __int8)CreateInfo & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v5 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)CreateInfo < 0x7FFFFFFF0000i64 )
      v5 = (__int64)CreateInfo;
    *(_BYTE *)v5 = *(_BYTE *)v5;
    *(_BYTE *)(v5 + 87) = *(_BYTE *)(v5 + 87);
  }
  if( CreateInfo[2] || *(_QWORD *)CreateInfo != 88i64 )
    return -1073741811;
  v6 = (32 * *((_BYTE *)CreateInfo + 16)) ^ (*((_BYTE *)CreateContext + 8) ^ (32 * *((_BYTE *)CreateInfo + 16))) & 0x7F;
  *((_BYTE *)CreateContext + 8) = v6;
  *((_BYTE *)CreateContext + 9) ^= (*((_BYTE *)CreateContext + 9) ^ (*((_BYTE *)CreateInfo + 16) >> 3)) & 1;
  CreateContext[40] = CreateInfo[5];
  v7 = v6 ^ (v6 ^ (2 * *((_BYTE *)CreateInfo + 16))) & 2;
  *((_BYTE *)CreateContext + 8) = v7;
  *((_BYTE *)CreateContext + 8) = v7 ^ (v7 ^ (8 * *((_BYTE *)CreateInfo + 16))) & 0x10;
  *((_WORD *)CreateContext + 5) = *((_WORD *)CreateInfo + 9);
  *((_QWORD *)CreateContext + 5) = CreateInfo;
  return v4;
}

Referenced by: