PspUserThreadStartup

VOID __stdcall PspUserThreadStartup(PKSTART_ROUTINE StartRoutine, PVOID StartContext){
  _ETHREAD *CurrentThread; 
  __int64 Process; 
  NTSTATUS SessionLocaleId; 
  __int64 v5; 
  struct _KPRCB *CurrentPrcb; 
  int PerformanceCounter; 
  int v8; 
  unsigned __int64 v9; 
  unsigned int v10; 
  _LARGE_INTEGER CurrentTime; 
  __int64 v12; 
  _ETHREAD *v13; 
  INT64 v14[14]; 

  CurrentTime.QuadPart = 0i64;
  __writecr8(0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v13 = CurrentThread;
  PspDisablePrimaryTokenExchange(CurrentThread);
  if( (CurrentThread->CrossThreadFlags & 2) == 0 )
    PspTerminateThreadByPointer(CurrentThread, 0xC000004Bui64, 1u);
  Process = (__int64)CurrentThread->Tcb.ApcState.Process;
  v12 = Process;
  if( (*(_DWORD *)(Process + 2172) & 1) != 0 )
  {
    DbgkCreateMinimalThread(CurrentThread);
  }
  else
  {
    SessionLocaleId = MmGetSessionLocaleId();
    *(_DWORD *)(v5 + 264) = SessionLocaleId;
    PspWriteTebIdealProcessor(CurrentThread, CurrentThread);
    DbgkCreateThread(CurrentThread);
    if( (*(_DWORD *)(Process + 1124) & 0x80000) == 0
      && !_interlockedbittestandset((volatile signed __int32 *)(Process + 1124), 0x13u) )
    {
      PfProcessCreateNotification((_EPROCESS *)Process, *(VOID **)(Process + 1304));
    }
  }
  while( !KUSER_SHARED_DATA.Cookie )
  {
    KeQuerySystemTimePrecise(&CurrentTime);
    CurrentPrcb = KeGetCurrentPrcb();
    PerformanceCounter = KeQueryPerformanceCounter(0i64);
    v8 = ExGenRandom(ExGenRandomDomainUserVisible);
    v9 = __rdtsc();
    _InterlockedCompareExchange(
      (volatile signed __int32 *)&KUSER_SHARED_DATA.Cookie,
      CurrentTime.anonymous_0.LowPart ^ CurrentTime.anonymous_0.HighPart ^ PerformanceCounter ^ v9 ^ v8 ^ CurrentPrcb->MmPageFaultCount ^ CurrentPrcb->InterruptCount ^ CurrentPrcb->InterruptTime,
      0);
  }
  if( (*(_BYTE *)(Process + 992) & 1) != 0 )
  {
    CurrentThread->SameThreadPassiveFlags |= 0x200u;
    memset(v14, 0i64, 0x68u);
    v10 = VslpEnterIumSecureMode(0, 0, KeGetCurrentThread()->SecureThreadCookie, (INT64)v14);
    PspTerminateThreadByPointer(CurrentThread, v10, 1u);
  }
  else if( (CurrentThread->CrossThreadFlags & 1) != 0 )
  {
    KeWaitForSingleObject((UINT64)CurrentThread, 6, 1, 0, 0i64);
  }
  else if( (*(_DWORD *)(Process + 2172) & 1) == 0 )
  {
    PspInitializeThunkContext();
  }
}

Referenced by: