KiProcessControlProtection

NTSTATUS __stdcall KiProcessControlProtection(INT64 a1){
  unsigned __int8 CurrentIrql; 
  unsigned __int64 v2; 
  unsigned __int64 v3; 
  INT64 v5; 
  NTSTATUS v6; 
  __int64 v7; 

  v7 = *(_QWORD *)(a1 + 360);
  v6 = 2;
  CurrentIrql = KeGetCurrentIrql();
  if( !CurrentIrql )
  {
    KeGetCurrentIrql();
    __writecr8(1ui64);
  }
  if( *(_WORD *)(a1 + 368) == 51 && *(_QWORD *)(a1 + 352) == 1i64 )
  {
    v2 = __readmsr(0x6A7u);
    if( (v2 & 7) == 0 )
    {
      v3 = *(_QWORD *)(a1 + 384);
      if( (v3 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v3 + 8 > 0x7FFFFFFF0000i64 || v3 + 8 < v3 )
        MEMORY[0x7FFFFFFF0000] = 0;
      v5 = *(_QWORD *)v3;
      if( (unsigned __int64)(*(_QWORD *)v3 - 0x10000i64) <= 0x7FFFFFFDFFFFi64
        && (unsigned __int64)(v7 - 0x10000) <= 0x7FFFFFFDFFFFi64 )
      {
        if( v5 == KeRaiseExceptionForReturnAddressHijack )
        {
          *(_QWORD *)v3 = *(_QWORD *)v2;
          v6 = 3;
        }
        else
        {
          do
          {
            v2 += 8i64;
            if( *(_QWORD *)v2 < 0x10000ui64 )
              break;
            if( *(_QWORD *)v2 == v5 )
            {
              __writemsr(0x6A7u, v2);
              v6 = 1;
              break;
            }
          }
          while( (v2 & 0xFFF) != 0 || (*(_DWORD *)&KeGetCurrentThread()[1].gapD8[8] & 1) == 0 );
        }
      }
    }
  }
  if( !CurrentIrql )
    __writecr8(0i64);
  return v6;
}

Referenced by: