KiSwapProcess

VOID __fastcall KiSwapProcess(_EPROCESS *NewProcess, _EPROCESS *OldProcess){
  struct _KPRCB *CurrentPrcb; 
  unsigned __int64 v4; 
  __int64 v5; 
  unsigned __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  CurrentPrcb = KeGetCurrentPrcb();
  v4 = *((unsigned __int8 *)CurrentPrcb + 209);
  v5 = 8i64 * *((unsigned __int8 *)CurrentPrcb + 208) + 376;
  _interlockedbittestandset64((volatile signed __int32 *)((char *)NewProcess + v5), v4);
  v6 = *((_QWORD *)NewProcess + 5);
  if( (_BYTE)KiKvaShadow )
  {
    v7 = *((_QWORD *)NewProcess + 5);
    if( (v6 & 2) != 0 )
      v7 = v6 | 0x8000000000000000ui64;
    __writegsqword(0x9000u, v7);
    KiSetAddressPolicy(*((_BYTE *)NewProcess + 912));
  }
  __writecr3(v6);
  if( !KiFlushPcid && (_BYTE)KiKvaShadow )
  {
    v8 = __readcr4();
    if( (v8 & 0x20080) != 0 )
    {
      __writecr4(v8 ^ 0x80);
      __writecr4(v8);
    }
    else
    {
      v9 = __readcr3();
      __writecr3(v9);
    }
  }
  _interlockedbittestandreset64((volatile signed __int32 *)((char *)OldProcess + v5), v4);
}

Referenced by: