KyStartUserThread

VOID __stdcall KyStartUserThread(
        INT64 SecurityDomain,
        INT64 BpbState,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        INT64 a9){
  INT64 v9; 
  _ETHREAD *CurrentThread; 
  unsigned __int8 BpbKernelSpecCtrl; 
  INT64 v12; 
  INT64 v13; 
  INT64 v14; 
  INT64 v15; 
  INT64 v16; 
  char v17; 
  __int16 v18; 

  BYTE3(v13) = 1;
  v14 = v9;
  v15 = SecurityDomain;
  v16 = BpbState;
  if( (v17 & 1) != 0 )
  {
    if( (KiKvaShadow & 1) == 0 )
      __swapgs();
    _mm_lfence();
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    SecurityDomain = CurrentThread->Tcb.Process->SecurityDomain;
    __writegsqword(0x270u, SecurityDomain);
    __writegsbyte(0x851u, KeGetPcr()->Prcb.BpbRetpolineExitSpecCtrl);
    LOBYTE(SecurityDomain) = KeGetPcr()->Prcb.BpbState;
    __writegsbyte(0x852u, SecurityDomain);
    BpbKernelSpecCtrl = KeGetPcr()->Prcb.BpbKernelSpecCtrl;
    if( KeGetPcr()->Prcb.BpbCurrentSpecCtrl != BpbKernelSpecCtrl )
    {
      __writegsbyte(0x27Au, BpbKernelSpecCtrl);
      SecurityDomain = 72i64;
      HIDWORD(BpbState) = 0;
      __writemsr(0x48u, BpbKernelSpecCtrl);
    }
    LODWORD(BpbState) = KeGetPcr()->Prcb.BpbState;
    if( (BpbState & 8) != 0 )
    {
      SecurityDomain = 73i64;
      __writemsr(0x49u, 1ui64);
      BpbState = KeGetPcr()->Prcb.BpbState;
      LODWORD(BpbState) = (unsigned __int8)BpbState;
    }
    if( (BpbState & 2) != 0 )
      __flush_rsb();
    _mm_lfence();
    __writegsbyte(0x853u, 0);
    if( (CurrentThread->Tcb.gap0[3] & 3) != 0 )
      KiSaveDebugRegisterState();
  }
  else
  {
    _mm_lfence();
    if( (KeGetPcr()->Prcb.BpbState & 1) != 0 )
    {
      SecurityDomain = 72i64;
      BpbState = 0i64;
      __writemsr(0x48u, KeGetPcr()->Prcb.BpbCurrentSpecCtrl);
    }
    else
    {
      _mm_lfence();
    }
  }
  HIDWORD(v13) = _mm_getcsr();
  _mm_setcsr(KeGetPcr()->Prcb._MxCsr);
  if( (_BYTE)KeSmapEnabled && (v17 & 1) != 0 )
    __stac();
  if( (v18 & 0x200) != 0 )
    _enable();
  KxStartUserThread(SecurityDomain, BpbState, a3, a4, v12, v13, v14, v15, v16);
}

Referenced by: