RtlpWow64CreateUserStack

UINT64 __fastcall RtlpWow64CreateUserStack(unsigned __int64 a1, unsigned __int64 a2, __int64 a3, int a4, __int64 a5){
  ULONG_PTR v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  UINT64 result; 
  __int64 v12; 
  unsigned __int64 v13; 
  NTSTATUS v14; 
  char *v15; 
  int v16; 
  IMAGE_NT_HEADERS *v17; 
  IMAGE_NT_HEADERS *v18; 
  unsigned __int64 SizeOfStackReserve_high; 
  unsigned int SizeOfStackReserve; 
  UINT64 AllocationType; 
  UINT64 AllocationTypea; 
  UINT64 Protect; 
  UINT64 Protecta; 
  PVOID BaseAddress; 
  int v26; 
  ULONG_PTR v27[2]; 
  ULONG_PTR RegionSize; 
  ULONG_PTR v29; 
  PVOID v30; 
  int ProcessInformation; 
  int v32; 
  int v33; 
  int v34; 
  unsigned __int64 v35; 
  __int64 v36; 
  __int64 v37; 
  unsigned __int64 v38; 
  unsigned __int64 v39; 
  v39 = a1;
  v27[0] = 0i64;
  v37 = 0i64;
  v7 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1360i64);
  v27[1] = v7;
  if( !a1 || (v8 = a2) == 0 )
  {
    v16 = 0;
    v17 = RtlImageNtHeader(*(PVOID *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1312i64));
    v18 = v17;
    if( v17 )
    {
      SizeOfStackReserve_high = HIDWORD(v17->OptionalHeader.SizeOfStackReserve);
      SizeOfStackReserve = v18->OptionalHeader.SizeOfStackReserve;
      a1 = v39;
      if( !v39 )
        a1 = SizeOfStackReserve_high;
      v8 = a2;
      if( !a2 )
        v8 = SizeOfStackReserve;
    }
    else
    {
      v16 = -1073741701;
      v26 = -1073741701;
      v8 = a2;
      a1 = v39;
    }
    if( v16 < 0 )
      return(unsigned int)v16;
  }
  if( !a1 )
    a1 = 0x4000i64;
  if( a1 >= v8 )
    v8 = (a1 + 0xFFFFF) & 0xFFFFFFFFFFF00000ui64;
  v9 = (a1 + 4095) & 0xFFFFFFFFFFFFF000ui64;
  v10 = (v8 + 0xFFFF) & 0xFFFFFFFFFFFF0000ui64;
  v38 = *(_QWORD *)(v7 + 792);
  if( v38 && v9 < v38 )
  {
    v9 = (v38 + 4095) & 0xFFFFFFFFFFFFF000ui64;
    v10 = (v9 + 0xFFFFF) & 0xFFFFFFFFFFF00000ui64;
  }
  ProcessInformation = a4;
  v32 = 0;
  v34 = 0;
  v33 = 0;
  v35 = v10;
  v36 = a3;
  result = ZwSetInformationProcess((GROUP_AFFINITY *)0xFFFFFFFFFFFFFFFFi64);
  if( (result & 0x80000000) == 0i64 )
  {
    v12 = v37;
    *(_QWORD *)(a5 + 56) = v37;
    *(_QWORD *)(a5 + 40) = v12 + v10;
    BaseAddress = (PVOID)(v10 + v12 - v9);
    v13 = v10 - v9;
    RegionSize = v9;
    LODWORD(Protect) = 4;
    LODWORD(AllocationType) = 4096;
    v14 = ZwAllocateVirtualMemory(
            (PVOID)0xFFFFFFFFFFFFFFFFi64,
            &BaseAddress,
            0i64,
            &RegionSize,
            AllocationType,
            Protect);
    if( v14 < 0
      || (v15 = (char *)BaseAddress, *(_QWORD *)(a5 + 48) = BaseAddress, v13 >= 0x2000)
      && (BaseAddress = v15 - 0x2000,
          v27[0] = 0x2000i64,
          LODWORD(Protecta) = 260,
          LODWORD(AllocationTypea) = 4096,
          v14 = ZwAllocateVirtualMemory(
                  (PVOID)0xFFFFFFFFFFFFFFFFi64,
                  &BaseAddress,
                  0i64,
                  v27,
                  AllocationTypea,
                  Protecta),
          v14 < 0) )
    {
      v30 = *(PVOID *)(a5 + 56);
      v29 = 0i64;
      ZwFreeVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &v30, &v29, 0x8000ui64);
      *(_QWORD *)(a5 + 56) = 0i64;
      *(_QWORD *)(a5 + 40) = 0i64;
      *(_QWORD *)(a5 + 48) = 0i64;
      return(unsigned int)v14;
    }
    else
    {
      return 0i64;
    }
  }
  return result;
}

Referenced by: