PspPrepareSystemDllInitBlock

NTSTATUS __stdcall PspPrepareSystemDllInitBlock(PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  __int64 v1; 
  __int64 v2; 
  __int64 v3; 
  __int64 v4; 
  __int64 v5; 
  _EPROCESS *Process; 
  __int64 v7; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned int ProcessNtdllType; 
  _QWORD *v10; 
  int v11; 
  unsigned __int8 i; 
  int v14; 
  _QWORD *SharedInformation; 
  __int64 v16; 
  unsigned __int16 Machine; 
  __int64 v18; 
  __int128 v19; 
  __int64 v20; 
  __int128 v21; 
  __int64 v22; 
  _MMPTE *v23; 
  _MMPTE *v24; 

  v2 = v1;
  v3 = 0i64;
  v4 = 0i64;
  v23 = 0i64;
  v5 = 0i64;
  v24 = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  if( (_DWORD)CreateContext )
  {
    v14 = (_DWORD)CreateContext - 1;
    if( v14 )
    {
      if( v14 != 1 )
        goto LABEL_3;
      SharedInformation = PspWow64GetSharedInformation(2i64);
    }
    else
    {
      SharedInformation = PspWow64GetSharedInformation(1i64);
    }
    v3 = SharedInformation[7];
    LODWORD(v16) = MmGetCfgBitMapInformation(1i64, &v23);
    v4 = v16;
    goto LABEL_3;
  }
  v3 = PspSystemDllInitBlock;
  LODWORD(v7) = MmGetCfgBitMapInformation((INT64)CreateContext, &v23);
  v4 = v7;
  WoW64Process = Process->WoW64Process;
  if( WoW64Process )
  {
    Machine = WoW64Process->Machine;
    if( Machine == 332 || Machine == 452 )
    {
      LODWORD(v18) = MmGetCfgBitMapInformation(1i64, &v24);
      v5 = v18;
    }
  }
LABEL_3:
  if( v2 )
  {
    v19 = *(_OWORD *)(v2 + 360);
    v20 = *(_QWORD *)(v2 + 376);
    v21 = *(_OWORD *)(v2 + 488);
    v22 = *(_QWORD *)(v2 + 504);
  }
  else
  {
    v19 = 0i64;
    v20 = 0i64;
    v21 = 0i64;
    v22 = 0i64;
  }
  if( *(_DWORD *)v3 != 240 )
    return -1073741735;
  *(_EX_FAST_REF *)(v3 + 16) = PspSystemDlls[8];
  ProcessNtdllType = PsWow64GetProcessNtdllType((INT64)Process);
  if( !ProcessNtdllType )
    ProcessNtdllType = 1;
  v10 = PspWow64GetSharedInformation(ProcessNtdllType);
  *(_EX_FAST_REF *)(v3 + 8) = (&PspSystemDlls)[v11][8];
  for( i = 0; i < 0x10u; ++i )
    *(_QWORD *)(v3 + 8i64 * i + 24) = v10[i];
  *(_DWORD *)(v3 + 152) = ExGenRandom(ExGenRandomDomainUserVisible);
  *(_DWORD *)(v3 + 156) = 0;
  if( v2 )
  {
    if( (*(_BYTE *)(v2 + 9) & 2) != 0 )
      *(_DWORD *)(v3 + 156) |= 1u;
  }
  *(_OWORD *)(v3 + 160) = v19;
  *(_QWORD *)(v3 + 176) = v20;
  *(_OWORD *)(v3 + 216) = v21;
  *(_QWORD *)(v3 + 232) = v22;
  *(_QWORD *)(v3 + 184) = v4;
  *(_QWORD *)(v3 + 192) = v23;
  *(_QWORD *)(v3 + 200) = v5;
  *(_QWORD *)(v3 + 208) = v24;
  return 0;
}

Referenced by: