PspCreateUserContext
NTSTATUS __stdcall PspCreateUserContext(INT64 a1, CHAR a2, INT64 a3, INT64 a4, INT64 a5){
NTSTATUS result;
if( (a2 & 1) == 0 )
*(_DWORD *)(a1 + 48) = 1048587;
*(_QWORD *)(a1 + 136) = a5;
*(_WORD *)(a1 + 66) = 43;
*(_QWORD *)(a1 + 248) = a3;
*(_QWORD *)(a1 + 128) = a4;
*(_WORD *)(a1 + 56) = 51;
result = 639;
*(_DWORD *)(a1 + 58) = 2818091;
*(_WORD *)(a1 + 256) = 639;
*(_DWORD *)(a1 + 62) = 2818131;
*(_DWORD *)(a1 + 52) = 8064;
*(_DWORD *)(a1 + 280) = 8064;
return result;
}Referenced by:
NtCreateThreadEx
NtCreateUserProcess
PspCreatePicoThread
PspInitializeThunkContext