PspSetupUserProcessAddressSpace

NTSTATUS __stdcall PspSetupUserProcessAddressSpace(
        _EPROCESS *ParentProcess,
        _EPROCESS *TargetProcess,
        _KAPC_STATE *ApcState,
        PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  VOID **v5; 
  unsigned int *v8; 
  int v10; 
  int v11; 
  unsigned int v12; 
  int v13; 
  _EJOB *v14; 
  int inited; 
  UINT64 v16; 
  PSP_CREATE_PROCESS_CONTEXT *v17; 
  INT64 v18; 
  int v19; 
  NTSTATUS result; 
  unsigned int ProcessNtdllType; 
  UINT64 AllocationType; 
  INT64 AllocationTypea; 
  UINT64 Protect; 
  INT64 Protecta; 
  UINT64 RegionSize; 
  INT64 CurrentThread; 
  VOID *StandardHandleList[2]; 
  __int64 v29; 

  RegionSize = 0i64;
  v5 = 0i64;
  v29 = 0i64;
  v8 = (unsigned int *)*((_QWORD *)CreateContext + 26);
  v10 = (*((unsigned __int8 *)CreateContext + 9) >> 2) & 3;
  CurrentThread = (INT64)KeGetCurrentThread();
  *(_OWORD *)StandardHandleList = 0i64;
  v11 = v10 - 1;
  if( v11 )
  {
    if( v11 == 1 )
      v5 = (VOID **)(v8 + 8);
  }
  else if( CreateContext[20] == CreateContext[72] )
  {
    v5 = StandardHandleList;
    result = PspGetStandardHandleList(ParentProcess, StandardHandleList);
    if( result < 0 )
      return result;
  }
  v12 = v8[2];
  v13 = v12 & 0x60;
  if( (PspGlobalFlags & 1) != 0 )
  {
    v12 |= 0x8000u;
    v8[2] = v12;
  }
  if( !v8[259] )
    v8[259] = PsDefaultLoaderThreads;
  LODWORD(v14) = PsGetProcessServerSilo((INT64)TargetProcess);
  if( PsGetServerSiloGlobals(v14)->OneCoreForwardersEnabled )
    v8[2] = v12 | 0x20000000;
  KiStackAttachProcess(TargetProcess, 0i64, ApcState);
  if( (CreateContext[2] & 0x10) == 0 || (inited = PspLocateInPEManifest(TargetProcess, CreateContext), inited >= 0) )
  {
    v16 = *v8 + *((_QWORD *)v8 + 126);
    RegionSize = v16;
    if( !v13 )
    {
      if( v16 < 0x20000 )
        v16 = 0x20000i64;
      RegionSize = v16;
    }
    LODWORD(Protect) = 4;
    *((_QWORD *)CreateContext + 27) = 0i64;
    LODWORD(AllocationType) = 12288;
    inited = ZwAllocateVirtualMemory(
               (VOID *)0xFFFFFFFFFFFFFFFFi64,
               (VOID **)CreateContext + 27,
               0i64,
               &RegionSize,
               AllocationType,
               Protect);
    if( inited >= 0 )
    {
      inited = PspCopyAndFixupParameters(ParentProcess, v5, CreateContext);
      if( inited >= 0 )
      {
        if( (*(_BYTE *)&KeGetCurrentThread()->ApcState.Process->Pcb.SecureState & 1) == 0 )
          inited = PspPrepareSystemDllInitBlock(0i64);
        if( inited >= 0 )
        {
          inited = PspWow64SetupUserProcessAddressSpace(
                     TargetProcess,
                     (_EPROCESS *)CreateContext,
                     v17,
                     v18,
                     AllocationTypea,
                     Protecta,
                     RegionSize,
                     CurrentThread);
          if( inited >= 0 )
          {
            if( TargetProcess->WoW64Process )
            {
              ProcessNtdllType = PsWow64GetProcessNtdllType((INT64)TargetProcess);
              inited = PspPrepareSystemDllInitBlock((PSP_CREATE_PROCESS_CONTEXT *)ProcessNtdllType);
            }
            if( inited >= 0 )
            {
              PspWritePebAffinityInfo((_ETHREAD *)CurrentThread, (_EX_RUNDOWN_REF *)TargetProcess);
              MmMapApiSetView(TargetProcess);
              inited = v19;
              if( v19 >= 0 )
                inited = PspMapSiloSharedDataView(TargetProcess);
            }
          }
        }
      }
    }
  }
  KiUnstackDetachProcess(ApcState, 0i64);
  return inited;
}

Referenced by: