KiInitializeUserApc

UINT64 __fastcall KiInitializeUserApc(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, char a7){
  UINT64 v8; 
  _ETHREAD *CurrentThread; 
  int v10; 
  INT64 v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  int v14; 
  _DWORD *v15; 
  unsigned __int64 v16; 
  UINT64 v17; 
  __int64 v18; 
  UINT64 UnbiasedInterruptTime; 
  _QWORD *v20; 
  char *i; 
  unsigned int v22; 
  __int64 v23; 
  NTSTATUS v24; 
  int v25; 
  unsigned __int64 v27; 
  _QWORD *v28; 
  INT64 result; 
  __int64 v30; 
  _QWORD *v31; 
  _WORD v34[8]; 
  _ETHREAD *v35; 
  UINT64 v36; 
  struct _EXCEPTION_RECORD ExceptionRecord; 
  memset((INT64)&ExceptionRecord, 0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v35 = CurrentThread;
  if( a1 )
  {
    v10 = 1048603;
    v25 = 1048603;
    v11 = 0i64;
    v30 = 0i64;
    if( (*((_DWORD *)CurrentThread + 29) & 0x100000) != 0 )
    {
      v10 = 1048667;
      v25 = 1048667;
      v11 = 2048i64;
      v30 = 2048i64;
    }
    v12 = *(_QWORD *)(a2 + 384);
    v27 = v12;
    v13 = v12;
    result = v12;
    v14 = v10 & 0x100040;
    if( (v10 & 0x100040) == 1048640 )
    {
      v13 = (v12 - (unsigned int)RtlpGetNonLegacyXStateAreaLength(v11)) & 0xFFFFFFFFFFFFFFC0ui64;
      result = v13;
      v12 = v27;
    }
    v28 = (_QWORD *)((v13 - 40) & 0xFFFFFFFFFFFFFFF0ui64);
    v31 = v28 - 4;
    v15 = v28 - 8;
    v16 = (unsigned __int64)(v28 - 162);
    v17 = v12 - (_QWORD)(v28 - 162);
    if( v17 - 1 > 0xFFE )
    {
      ProbeForWrite(v28 - 162, v17, 0x10ui64);
    }
    else
    {
      if( v16 >= 0x7FFFFFFF0000i64 )
        v16 = 0x7FFFFFFF0000i64;
      *(_BYTE *)v16 = *(_BYTE *)v16;
      *(_BYTE *)(v16 + v17 - 1) = *(_BYTE *)(v16 + v17 - 1);
      v15 = v28 - 8;
      v10 = v25;
      v16 = (unsigned __int64)(v28 - 162);
      v28 = (_QWORD *)((v13 - 40) & 0xFFFFFFFFFFFFFFF0ui64);
      v13 = result;
      v11 = v30;
    }
    *(_OWORD *)v31 = 0i64;
    v31[2] = 0i64;
    *(_DWORD *)v31 = 1;
    *((_DWORD *)v31 + 1) = 2;
    if( (a7 & 1) != 0 )
      *((_DWORD *)v31 + 1) = 3;
    if( v14 == 1048640 )
    {
      *v15 = -1232;
      v15[1] = *(_DWORD *)(a2 + 384) - v16;
      v15[2] = -1232;
      v15[3] = 1232;
      v15[4] = v13 - (_DWORD)v15;
      v15[5] = *(_DWORD *)(a2 + 384) - v13;
      memset(v13, 0i64);
      if( (KUSER_SHARED_DATA.XState.ControlFlags & 2) != 0 )
        *(_QWORD *)(v13 + 8) = v11 | 0x8000000000000000ui64;
    }
    *(_DWORD *)(v16 + 48) = v10;
    KeContextFromKframes((_KTRAP_FRAME *)a2, (_KEXCEPTION_FRAME *)a1, (_CONTEXT *)v16);
    v28[3] = *(_QWORD *)(v16 + 152);
    v18 = *(_QWORD *)(v16 + 248);
    *v28 = v18;
    KePopulateContinuationContext(v18);
  }
  else
  {
    v16 = *(_QWORD *)(a2 + 208);
    if( (*((_DWORD *)CurrentThread + 29) & 0x100000) != 0 )
    {
      v24 = KiUnwindUserSspForApcContextCopyBypass(v16);
      if( v24 < 0 )
        RtlRaiseStatus(v24);
    }
  }
  *(_QWORD *)v16 = a4;
  *(_QWORD *)(v16 + 8) = a5;
  *(_QWORD *)(v16 + 16) = a6;
  *(_QWORD *)(v16 + 24) = a3;
  *(_QWORD *)(a2 + 384) = v16;
  *(_QWORD *)(a2 + 360) = KeUserApcDispatcher;
  *(_WORD *)(a2 + 368) = 51;
  if( *(_BYTE *)(a2 + 43) != 2 )
    KiSetupForInstrumentationReturn((KTRAP_FRAME *)a2, v8);
  UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u);
  v36 = UnbiasedInterruptTime;
  if( UnbiasedInterruptTime >= qword_140C4C530 )
  {
    __sidt(v34);
    v20 = *(_QWORD **)&v34[1];
    for( i = *(char **)&v34[1]; (unsigned __int64)i < *(_QWORD *)&v34[1] + 848i64; i += 64 )
      _mm_prefetchnta(i);
    v22 = 848;
    v23 = qword_140C4C520;
    while( v22 >= 8 )
    {
      v23 = __ROR8__(v23 - *v20++, qword_140C4C528);
      v22 -= 8;
    }
    while( v22 )
    {
      v23 = __ROR8__(v23 - *(unsigned __int8 *)v20, qword_140C4C528);
      v20 = (_QWORD *)((char *)v20 + 1);
      --v22;
    }
    if( qword_140C4C538 != v23 )
    {
      if( qword_140C4C4F0 )
        goto LABEL_29;
      qword_140C4C4F0 = (unsigned int)__ROR4__(150994945, 88);
      qword_140C4C4F8 = 0i64;
      qword_140C4C500 = 0i64;
      qword_140C4C508 = 269i64;
      qword_140C4C510 = *(_QWORD *)&v34[1];
    }
    if( !qword_140C4C4F0 )
    {
LABEL_28:
      UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u)
                            + 41929663 * (__rdtsc() >> 4) % 0x12A05F2000i64
                            + 288000000000i64;
      qword_140C4C530 = UnbiasedInterruptTime;
      return UnbiasedInterruptTime;
    }
LABEL_29:
    if( (VOID(__stdcall *)(KDPC *, PVOID, PVOID, PVOID))Dpc.DeferredRoutine != KiScanQueues )
    {
      Dpc.TargetInfoAsUlong = 275;
      Dpc.DeferredRoutine = (void(__fastcall *)(_KDPC *, void *, void *, void *))KiScanQueues;
      Dpc.DeferredContext = &Dpc;
      Dpc.DpcData = 0i64;
      Dpc.ProcessorHistory = 0i64;
    }
    qword_140C4C518 = 940992i64;
    KeInsertQueueDpc(&Dpc, 0i64, 0i64);
    goto LABEL_28;
  }
  return UnbiasedInterruptTime;
}

Referenced by: