PspSetupUserShadowStack

NTSTATUS __fastcall PspSetupUserShadowStack(ULONG_PTR BugCheckParameter1, _DWORD *a2, __int64 a3, _BYTE *a4, int a5){
  NTSTATUS result; 
  int v10; 
  CHAR *ExtendedFeature; 
  INT64 v12; 
  INT64 v13; 
  UINT64 a2a; 
  INT64 v15; 
  INT64 a4a; 
  UINT64 v17; 
  _KAPC_STATE ApcState; 
  v15 = 0i64;
  v17 = 0i64;
  a2a = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  result = RtlCalculateUserShadowStackSizes(a3, &a2a);
  if( result >= 0 )
  {
    KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
    a4a = 0i64;
    v10 = PspReserveAndCommitUserShadowStack(a2a, v17, (unsigned int)a5, &a4a, &v15);
    if( v10 < 0 )
    {
      v12 = a4a;
    }
    else
    {
      if( (a2[12] & 0x100040) == 1048640 )
      {
        ExtendedFeature = RtlLocateExtendedFeature(a2 + 308, 0xBui64, 0i64);
        if( ExtendedFeature )
        {
          *(_QWORD *)((char *)a2 + a2[312] + 1232) |= 0x800ui64;
          *((_QWORD *)ExtendedFeature + 1) = v15;
          *(_QWORD *)ExtendedFeature = 1i64;
        }
      }
      *(_QWORD *)(a3 + 64) = a4a;
      *a4 |= 8u;
      v12 = 0i64;
    }
    if( v12 )
    {
      v15 = 0i64;
      LODWORD(v13) = 0x40000000;
      a2a = v12;
      MmFreeVirtualMemory(-1i64, &a2a, &v15, 0x8000i64, 0, v13);
    }
    KiUnstackDetachProcess(&ApcState, 0i64);
    return v10;
  }
  return result;
}

Referenced by: