KiEmulateAtlThunk

UINT64 __stdcall KiEmulateAtlThunk(
        UINT64 *InstructionPointer,
        UINT64 *StackPointer,
        UINT64 *Eax,
        UINT64 *Ecx,
        UINT64 *Edx){
  _DWORD *v10; 
  _WORD *v11; 
  char v12; 
  unsigned int v13; 
  __int64 v14; 
  char v15; 
  unsigned int v16; 
  unsigned int v17; 
  _DWORD *v18; 
  __int64 v19; 
  VOID *v20; 
  unsigned int v21; 
  _DWORD *StackPointera; 

  if( (KeGetCurrentThread()->ApcState.Process->Pcb.Flags._bf_0 & 4) != 0 )
    return 0i64;
  v10 = (_DWORD *)*(unsigned int *)InstructionPointer;
  StackPointera = (_DWORD *)*(unsigned int *)StackPointer;
  v21 = 0;
  v11 = (_WORD *)&KeGetPcr()->NtTib.$8E581AA5F14182E3A9376D7C6777905F::$DDD217EC770DED536E77C25F6874D4CC::Self[218].SubSystemTib
      + 1;
  if( (*v11 & 1) != 0 )
  {
    v12 = 1;
    *v11 &= ~1u;
  }
  else
  {
    v12 = 0;
  }
  if( *v10 == 69485767 && *((_BYTE *)v10 + 8) == 0xE9 )
  {
    v13 = *(_DWORD *)((char *)v10 + 9) + (_DWORD)v10 + 13;
    if( !MmCheckForSafeExecution(v10, StackPointera, (VOID *)v13, 1u) || !v12 )
      return v21;
    v14 = (__int64)(StackPointera + 1);
    if( (unsigned __int64)(StackPointera + 1) >= 0x7FFFFFFF0000i64 )
      v14 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v14 = v10[1];
    *(_DWORD *)InstructionPointer = v13;
    return 1;
  }
  v15 = *(_BYTE *)v10;
  if( *(_BYTE *)v10 == 0xB9 && *((_BYTE *)v10 + 5) == 0xE9 )
  {
    v16 = *(_DWORD *)((char *)v10 + 6) + (_DWORD)v10 + 10;
    if( !MmCheckForSafeExecution(v10, StackPointera, (VOID *)v16, 1u) || !v12 )
      return v21;
    *(_DWORD *)Ecx = *(_DWORD *)((char *)v10 + 1);
    goto LABEL_31;
  }
  if( v15 == -70 && *((_BYTE *)v10 + 5) == 0xB9 && *((_WORD *)v10 + 5) == 0xE1FF )
  {
    v17 = *(_DWORD *)((char *)v10 + 6);
    if( MmCheckForSafeExecution(v10, StackPointera, (VOID *)v17, 0) )
    {
      *(_DWORD *)Edx = *(_DWORD *)((char *)v10 + 1);
      *(_DWORD *)Ecx = v17;
      *(_DWORD *)InstructionPointer = v17;
      return 1;
    }
  }
  else
  {
    if( v15 != -71 || *((_BYTE *)v10 + 5) != 0xB8 || *((_WORD *)v10 + 5) != 0xE0FF )
    {
      if( v15 == 89
        && *((_BYTE *)v10 + 1) == 88
        && *((_BYTE *)v10 + 2) == 81
        && *((_BYTE *)v10 + 3) == 0xFF
        && *((_BYTE *)v10 + 4) == 96
        && *((_BYTE *)v10 + 5) == 4 )
      {
        v18 = StackPointera + 1;
        v19 = (__int64)(StackPointera + 1);
        if( (unsigned __int64)(StackPointera + 1) >= 0x7FFFFFFF0000i64 )
          v19 = 0x7FFFFFFF0000i64;
        v20 = (VOID *)*(unsigned int *)(unsigned int)(*(_DWORD *)v19 + 4);
        if( MmCheckForSafeExecution(v10, StackPointera, v20, 0) )
        {
          *(_DWORD *)Ecx = *StackPointera;
          *(_DWORD *)Eax = *v18;
          *v18 = *(_DWORD *)Ecx;
          *(_DWORD *)InstructionPointer = (_DWORD)v20;
          *(_DWORD *)StackPointer = (_DWORD)v18;
          return 1;
        }
      }
      return v21;
    }
    v16 = *(_DWORD *)((char *)v10 + 6);
    if( MmCheckForSafeExecution(v10, StackPointera, (VOID *)v16, 1u) && v12 )
    {
      *(_DWORD *)Ecx = *(_DWORD *)((char *)v10 + 1);
      *(_DWORD *)Eax = v16;
LABEL_31:
      *(_DWORD *)InstructionPointer = v16;
      return 1;
    }
  }
  return v21;
}

Referenced by: