MiStackTheftIsr

PVOID __stdcall MiStackTheftIsr(PVOID Argument){
  void *v1; 
  unsigned __int8 CurrentIrql; 
  signed __int32 v4; 
  unsigned int v5; 
  _MMPFN *PfnDb; 
  INT64 v7; 
  INT64 v8; 
  char v9; 
  signed __int32 v10; 
  unsigned int v11; 
  signed __int32 v12; 
  PVOID result; 
  UINT64 SpinCount; 
  UINT64 v15; 
  UINT64 v16; 
  v1 = (void *)*((_QWORD *)Argument + 6);
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(0xFui64);
  LODWORD(v15) = 0;
  v4 = _InterlockedDecrement((volatile signed __int32 *)Argument + 18);
  v5 = ~v4 & 0x80000000;
  if( (v4 & 0x7FFFFFFF) != 0 )
  {
    while( (*((_DWORD *)Argument + 18) & 0x80000000) != v5 )
      KeYieldProcessorEx(&v15);
    LODWORD(v16) = 0;
    v12 = _InterlockedDecrement((volatile signed __int32 *)Argument + 18);
    v11 = ~v12 & 0x80000000;
    if( (v12 & 0x7FFFFFFF) == 0 )
      goto LABEL_3;
    while( (*((_DWORD *)Argument + 18) & 0x80000000) != v11 )
      KeYieldProcessorEx(&v16);
  }
  else
  {
    PfnDb = MmGetPfnDb();
    *((_DWORD *)Argument + 18) = v5 | *((_DWORD *)Argument + 19);
    v7 = (INT64)PfnDb + 48 * *(_QWORD *)Argument;
    v8 = (INT64)PfnDb + 48 * *((_QWORD *)Argument + 1);
    MiCopyKstack(v8, v7, *((_QWORD *)Argument + 2));
    KeFlushSingleCurrentTb(v1);
    MiSwitchKstackPages(v8, v7);
    *(_QWORD *)(v7 + 40) &= ~0x8000000000000000ui64;
    *(_BYTE *)(v7 + 34) &= 0xC7u;
    v9 = *(_BYTE *)(v7 + 35) & 0xDF;
    LODWORD(SpinCount) = 0;
    *(_BYTE *)(v7 + 35) = v9;
    v10 = _InterlockedDecrement((volatile signed __int32 *)Argument + 18);
    v11 = ~v10 & 0x80000000;
    if( (v10 & 0x7FFFFFFF) == 0 )
    {
LABEL_3:
      *((_DWORD *)Argument + 18) = v11 | *((_DWORD *)Argument + 19);
      goto LABEL_13;
    }
    while( (*((_DWORD *)Argument + 18) & 0x80000000) != v11 )
      KeYieldProcessorEx(&SpinCount);
  }
LABEL_13:
  KeFlushSingleCurrentTb(v1);
  result = (PVOID)CurrentIrql;
  __writecr8(CurrentIrql);
  return result;
}

Referenced by: