NtCallbackReturn

NTSTATUS __stdcall NtCallbackReturn(PVOID OutputBuffer, UINT64 OutputLength, INT64 Status){
  _ETHREAD *CurrentThread; 
  _QWORD *v4; 
  __int64 v5; 
  NTSTATUS result; 
  __int64 v7; 
  _QWORD *v8; 
  bool v9; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned __int64 v13; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = (_QWORD *)*((_QWORD *)CurrentThread + 5);
  v5 = v4[4];
  if( v5 >= 0 )
  {
    if( v5 > 0 )
      KeBugCheckEx(0x1CDu, (ULONG_PTR)CurrentThread, v4[4], 0i64, 0i64);
    return -1073741224;
  }
  else
  {
    result = Status;
    **(_QWORD **)(v5 + 216) = OutputBuffer;
    **(_DWORD **)(v5 + 224) = OutputLength;
    _disable();
    v7 = *(_QWORD *)(v5 + 208);
    v8 = (_QWORD *)*((_QWORD *)CurrentThread + 18);
    *((_QWORD *)CurrentThread + 18) = v7;
    v9 = (*((_BYTE *)CurrentThread + 3) & 3) == 0;
    *(_WORD *)(v7 + 256) = 0;
    if( !v9 )
    {
      v10 = v8[28];
      *(_QWORD *)(v7 + 216) = v8[27];
      *(_QWORD *)(v7 + 224) = v10;
      v11 = v8[30];
      *(_QWORD *)(v7 + 232) = v8[29];
      *(_QWORD *)(v7 + 240) = v11;
      *(_QWORD *)(v7 + 256) = v8[32];
    }
    v12 = v4[2];
    *((_QWORD *)CurrentThread + 7) = v12;
    *((_QWORD *)CurrentThread + 6) = v12 - (unsigned int)KeKernelStackSize;
    v13 = v4[5];
    *((_QWORD *)CurrentThread + 5) = v13;
    if( (KiKvaShadow & 1) != 0 )
      __writegsqword(0x9008u, v13);
    else
      *(_QWORD *)(*((_QWORD *)KeGetPcr() + 1) + 4i64) = v13;
    __writegsqword(0x1A8u, v13);
    _enable();
  }
  return result;
}

Referenced by: