PspCreateUserContext

NTSTATUS __stdcall PspCreateUserContext(INT64 a1, CHAR a2, INT64 a3, INT64 a4, INT64 a5){
  NTSTATUS result; 

  if( (a2 & 1) == 0 )
    *(_DWORD *)(a1 + 48) = 1048587;
  *(_QWORD *)(a1 + 136) = a5;
  *(_WORD *)(a1 + 66) = 43;
  *(_QWORD *)(a1 + 248) = a3;
  *(_QWORD *)(a1 + 128) = a4;
  *(_WORD *)(a1 + 56) = 51;
  result = 639;
  *(_DWORD *)(a1 + 58) = 2818091;
  *(_WORD *)(a1 + 256) = 639;
  *(_DWORD *)(a1 + 62) = 2818131;
  *(_DWORD *)(a1 + 52) = 8064;
  *(_DWORD *)(a1 + 280) = 8064;
  return result;
}

Referenced by:

NtCreateThreadEx
NtCreateUserProcess
PspCreatePicoThread
PspInitializeThunkContext