PspInitializeThunkContext

VOID __stdcall PspInitializeThunkContext(){
  _ETHREAD *CurrentThread; 
  unsigned int v1; 
  NTSTATUS ExtendedContextLength; 
  INT64 v3; 
  unsigned __int64 v4; 
  void *v5; 
  char *v6; 
  void *InstrumentationCallback; 
  __int64 v8; 
  _KPROCESSOR_MODE v9; 
  _KTRAP_FRAME *InitialStack; 
  _KTRAP_FRAME *i; 
  _BYTE Buffer[1424]; 

  memset(&Buffer[60], 0i64, 0x7Cu);
  memset(&Buffer[4], 0, 20);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *(_QWORD *)&Buffer[24] = CurrentThread;
  v1 = ((unsigned __int32)CurrentThread->Tcb._bf_0 >> 14) & 0x40 | 0x10001B;
  ExtendedContextLength = RtlGetExtendedContextLength(v1, (UINT64 *)&Buffer[4]);
  if( ExtendedContextLength >= 0 )
  {
    v3 = *(unsigned int *)&Buffer[4];
    v4 = *(unsigned int *)&Buffer[4] + 15i64;
    if( v4 <= *(unsigned int *)&Buffer[4] )
      v4 = 0xFFFFFFFFFFFFFF0i64;
    v5 = alloca(v4 & 0xFFFFFFFFFFFFFFF0ui64);
    memset(Buffer, 0i64, *(size_t *)&Buffer[4]);
    ExtendedContextLength = RtlInitializeExtendedContext(Buffer, v1, (_CONTEXT_EX **)&Buffer[8]);
    if( ExtendedContextLength >= 0 )
    {
      memset(&Buffer[192], 0i64, 0x4D0u);
      --CurrentThread->Tcb.SpecialApcDisable;
      PspCallThreadNotifyRoutines(CurrentThread, 1u, 1u);
      ExtendedContextLength = PspGetContextThreadInternal(CurrentThread, (_CONTEXT *)Buffer, 0, 1, 0);
      *(_DWORD *)Buffer = ExtendedContextLength;
      if( ExtendedContextLength >= 0 )
      {
        v6 = (char *)((*(_QWORD *)&Buffer[152] - v3) & 0xFFFFFFFFFFFFFFF0ui64);
        *(_QWORD *)&Buffer[344] = v6 - 40;
        PspCreateUserContext((INT64)&Buffer[192], 0, PspLoaderInitRoutine, (INT64)v6, (INT64)PspSystemDlls[5].Object);
        InstrumentationCallback = CurrentThread->Tcb.ApcState.Process->Pcb.InstrumentationCallback;
        if( InstrumentationCallback )
        {
          *(_QWORD *)&Buffer[392] = *(_QWORD *)&Buffer[440];
          *(_QWORD *)&Buffer[440] = InstrumentationCallback;
        }
        v8 = (__int64)v6;
        if( (unsigned __int64)(v3 - 1) > 0xFFE )
        {
          ProbeForWrite((UINT64)v6, v3, 16i64);
        }
        else
        {
          if( (unsigned __int64)v6 >= 0x7FFFFFFF0000i64 )
            v8 = 0x7FFFFFFF0000i64;
          *(_BYTE *)v8 = *(_BYTE *)v8;
          *(_BYTE *)(v8 + v3 - 1) = *(_BYTE *)(v8 + v3 - 1);
        }
        ExtendedContextLength = RtlInitializeExtendedContext(v6, v1, (_CONTEXT_EX **)&Buffer[16]);
        *(_DWORD *)Buffer = ExtendedContextLength;
        if( ExtendedContextLength >= 0 )
        {
          ExtendedContextLength = RtlCopyContext((_X86_NT5_CONTEXT *)v6, v1, (_X86_NT5_CONTEXT *)Buffer);
          *(_DWORD *)Buffer = ExtendedContextLength;
          if( ExtendedContextLength >= 0 )
            KePopulateContinuationContext(*(INT64 *)&Buffer[248]);
        }
        if( ExtendedContextLength >= 0 )
          ExtendedContextLength = PspSetContextThreadInternal(CurrentThread, (_CONTEXT *)&Buffer[192], 0, 1, 2u);
      }
    }
  }
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( ExtendedContextLength < 0 )
  {
    *(_DWORD *)&Buffer[36] = 0;
    *(_QWORD *)&Buffer[48] = PspLoaderInitRoutine;
    *(_DWORD *)&Buffer[32] = ExtendedContextLength;
    *(_DWORD *)&Buffer[56] = 0;
    *(_QWORD *)&Buffer[40] = 0i64;
    InitialStack = (_KTRAP_FRAME *)CurrentThread->Tcb.InitialStack;
    for( i = InitialStack; (i->P2Home & 1) != 0; i = *(_KTRAP_FRAME **)&i->PreviousMode )
      ;
    if( (InitialStack->P2Home & 1) != 0 )
    {
      do
        InitialStack = *(_KTRAP_FRAME **)&InitialStack->PreviousMode;
      while( (InitialStack->P2Home & 1) != 0 );
    }
    LOBYTE(v9) = 1;
    KiDispatchException((PEXCEPTION_RECORD)&Buffer[32], (PKEXCEPTION_FRAME)&InitialStack[-2]._R9, i - 1, v9, 0);
  }
}

Referenced by: