PspShutdownCsrProcess

VOID __stdcall PspShutdownCsrProcess(_EJOB *Silo, UINT64 SessionId, _EPROCESS *CsrProcess){
  _EJOB *v4; 
  _EJOB *v5; 
  NTSTATUS Event; 
  VOID *v7; 
  NTSTATUS v8; 
  _HANDLE v9; 
  VOID *Handle; 
  VOID *EventHandle; 
  UINT64 SessionIda; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _KAPC_STATE ApcState; 
  WCHAR pszDest[120]; 

  LODWORD(SessionIda) = SessionId;
  memset(&ApcState, 0, sizeof(ApcState));
  Handle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  EventHandle = 0i64;
  LODWORD(v4) = PsAttachSiloToCurrentThread((INT64)Silo);
  v5 = v4;
  RtlStringCchPrintfW(pszDest, 0x78ui64, (WCHAR *)&stru_1407D6010._MxCsr);
  RtlInitUnicodeString(&DestinationString, pszDest);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ZwOpenEvent(&EventHandle, 2031619, &ObjectAttributes);
  RtlStringCchPrintfW(pszDest, 0x78ui64, (WCHAR *)&stru_1407D6010._Xmm12);
  RtlInitUnicodeString(&DestinationString, pszDest);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 704;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  Event = ZwCreateEvent((UINT64)&Handle, 0x1F0003ui64, (INT64)&ObjectAttributes, 0i64, 0);
  v7 = Handle;
  if( Event < 0 )
    v7 = 0i64;
  Handle = v7;
  PsDetachSiloFromCurrentThread(v5);
  KiStackAttachProcess(CsrProcess, 0i64, &ApcState);
  v8 = PsInvokeWin32Callout(Win32WakeRitForShutdownCallout, 0i64, PsWin32SessionAttachSingle, &SessionIda);
  KiUnstackDetachProcess(&ApcState, 0i64);
  if( EventHandle )
  {
    ZwSetEvent(EventHandle, 0i64);
    ZwClose((_HANDLE)EventHandle);
    EventHandle = 0i64;
  }
  v9 = (int)Handle;
  if( Handle )
  {
    if( v8 >= 0 )
    {
      ZwWaitForSingleObject((UINT64)Handle, 0, 0i64);
      v9 = (int)Handle;
    }
    ZwClose(v9);
    Handle = 0i64;
  }
  if( PsTerminateProcess((ULONG_PTR)CsrProcess, 0xC00002EBui64) >= 0 )
    PspWaitForUsermodeExit(CsrProcess);
}

Referenced by: