KiUmsFastReturnToUser

VOID __stdcall KiUmsFastReturnToUser(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  _ETHREAD *CurrentThread; 
  __int64 p_Xmm1; 
  __int64 v6; 
  UINT32 v7; 
  void *CombinedApcDisable; 
  void *CurrentIrql; 
  _ETHREAD *v10; 
  _ETHREAD *v11; 
  void *InstrumentationCallback; 
  unsigned __int8 BpbUserSpecCtrl; 
  unsigned __int8 v14; 
  void *v17; 
  CHAR v18; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  p_Xmm1 = (__int64)&CurrentThread->Tcb.TrapFrame->_Xmm1;
  v6 = CurrentThread->Tcb.WaitBlock[3].SpareLong | (unsigned int)(unsigned __int8)(CurrentThread->Tcb.ApcStateIndex | KeGetCurrentIrql());
  if( (_DWORD)v6 )
  {
    v7 = 74;
    CombinedApcDisable = 0i64;
    CurrentIrql = (void *)KeGetCurrentIrql();
    if( !(_DWORD)CurrentIrql )
    {
      v7 = 1;
      CurrentIrql = (void *)CurrentThread->Tcb.ApcStateIndex;
      CombinedApcDisable = (void *)CurrentThread->Tcb.CombinedApcDisable;
    }
    KiBugCheckDispatch(v7, (void *)CurrentThread->Tcb.TrapFrame->_Rip, CurrentIrql, CombinedApcDisable);
  }
  _disable();
  while( (KeGetCurrentThread()->ApcState.UserApcPendingAll & 3) != 0 )
  {
    *(_QWORD *)(p_Xmm1 - 80) = v6;
    *(_QWORD *)(p_Xmm1 - 72) = 0i64;
    *(_QWORD *)(p_Xmm1 - 64) = 0i64;
    *(_QWORD *)(p_Xmm1 - 56) = 0i64;
    *(_QWORD *)(p_Xmm1 - 48) = 0i64;
    *(_QWORD *)(p_Xmm1 - 40) = 0i64;
    *(_QWORD *)(p_Xmm1 - 32) = 0i64;
    *(_OWORD *)(p_Xmm1 - 16) = 0i64;
    *(_OWORD *)p_Xmm1 = 0i64;
    *(_OWORD *)(p_Xmm1 + 16) = 0i64;
    *(_OWORD *)(p_Xmm1 + 32) = 0i64;
    *(_OWORD *)(p_Xmm1 + 48) = 0i64;
    *(_OWORD *)(p_Xmm1 + 64) = 0i64;
    __writecr8(1ui64);
    _enable();
    KiInitiateUserApc((_KTRAP_FRAME *)1);
    _disable();
    __writecr8(0i64);
    v6 = *(_QWORD *)(p_Xmm1 - 80);
  }
  if( (*((_BYTE *)&KeGetPcr()->Prcb.2 + 14) & 2) != 0 )
  {
    *(_QWORD *)(p_Xmm1 - 80) = v6;
    KiUpdateStibpPairing(0i64);
    v6 = *(_QWORD *)(p_Xmm1 - 80);
  }
  v10 = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_DWORD *)v10->Tcb.gap0 & 0x8000000) != 0 )
  {
    *(_QWORD *)(p_Xmm1 - 80) = v6;
    *(_QWORD *)(p_Xmm1 - 72) = 0i64;
    *(_QWORD *)(p_Xmm1 - 64) = 0i64;
    *(_QWORD *)(p_Xmm1 - 56) = 0i64;
    *(_QWORD *)(p_Xmm1 - 48) = 0i64;
    *(_QWORD *)(p_Xmm1 - 40) = 0i64;
    *(_QWORD *)(p_Xmm1 - 32) = 0i64;
    *(_OWORD *)(p_Xmm1 - 16) = 0i64;
    *(_OWORD *)p_Xmm1 = 0i64;
    *(_OWORD *)(p_Xmm1 + 16) = 0i64;
    *(_OWORD *)(p_Xmm1 + 32) = 0i64;
    *(_OWORD *)(p_Xmm1 + 48) = 0i64;
    *(_OWORD *)(p_Xmm1 + 64) = 0i64;
    KiRestoreSetContextState((INT64)v10, a2, a3, a4, v18);
  }
  v11 = (_ETHREAD *)KeGetCurrentThread();
  if( (*(_DWORD *)v11->Tcb.gap0 & 0x40010000) != 0 )
  {
    *(_QWORD *)(p_Xmm1 - 80) = v6;
    if( (v11->Tcb.gap0[2] & 1) != 0 )
    {
      KiCopyCounters(&v11->Tcb);
      v11 = (_ETHREAD *)KeGetCurrentThread();
    }
    if( (v11->Tcb.gap0[3] & 0x40) != 0 )
      KiUmsExit(0);
    v6 = *(_QWORD *)(p_Xmm1 - 80);
  }
  _mm_setcsr(*(_DWORD *)(p_Xmm1 - 84));
  if( *(_WORD *)(p_Xmm1 + 128) )
  {
    *(_QWORD *)(p_Xmm1 - 80) = v6;
    KiRestoreDebugRegisterState();
    InstrumentationCallback = KeGetCurrentThread()->ApcState.Process->Pcb.InstrumentationCallback;
    if( InstrumentationCallback && *(_WORD *)(p_Xmm1 + 240) == 51 )
      *(_QWORD *)(p_Xmm1 + 232) = InstrumentationCallback;
    v6 = *(_QWORD *)(p_Xmm1 - 80);
  }
  *(_QWORD *)(p_Xmm1 - 80) = v6;
  __writegsbyte(0x853u, 0);
  BpbUserSpecCtrl = KeGetPcr()->Prcb.BpbUserSpecCtrl;
  if( KeGetPcr()->Prcb.BpbCurrentSpecCtrl != BpbUserSpecCtrl )
  {
    __writegsbyte(0x27Au, BpbUserSpecCtrl);
    __writemsr(0x48u, BpbUserSpecCtrl);
  }
  v14 = _bittestandreset16(MK_FP(__GS__, 632i64), 2u);
  if( v14 )
    __writemsr(0x49u, 1ui64);
  v14 = _bittestandreset16(MK_FP(__GS__, 632i64), 5u);
  if( v14 )
    __flush_rsb();
  v17 = *(void **)(p_Xmm1 + 232);
  if( (KiKvaShadow & 1) == 0 )
  {
    __swapgs();
    __sysretq(v17, *(_QWORD *)(p_Xmm1 + 248));
  }
  KiKernelSysretExit(v17);
}

Referenced by: