KiLogUserCetSetContextIpValidationFailure

UINT64 __stdcall KiLogUserCetSetContextIpValidationFailure(INT64 a1, INT64 a2, INT64 a3, UINT8 a4){
  int v5; 
  int v6; 
  int v7; 
  _EPROCESS *Process; 
  UINT64 result; 
  int v10; 
  _WORK_QUEUE_ITEM *Pool2; 
  INT64 v12; 

  v5 = a4;
  v6 = a2;
  v7 = a1;
  Process = KeGetCurrentThread()->Process;
  _m_prefetchw(&Process->2516);
  LODWORD(result) = Process->MitigationFlags2;
  do
  {
    v10 = result;
    result = (unsigned int)_InterlockedCompareExchange(
                             (volatile signed __int32 *)&Process->2516,
                             result | 0x80000,
                             result);
  }
  while( v10 != (_DWORD)result );
  if( (result & 0x80000) == 0 )
  {
    Pool2 = (_WORK_QUEUE_ITEM *)ExAllocatePool2(256i64, 0x40ui64, 0x63736C4Bui64);
    if( Pool2 )
    {
      if( ExAcquireRundownProtection(&Process->RundownProtect) )
      {
        ObfReferenceObject(Process);
        Pool2->List.Flink = 0i64;
        Pool2->WorkerRoutine = (void(__fastcall *)(void *))KiLogUserCetSetContextIpValidationFailureWorker;
        Pool2->Parameter = Pool2;
        LODWORD(Pool2[1].List.Flink) = v7;
        Pool2[1].List.Blink = (_LIST_ENTRY *)Process;
        Pool2[1].WorkerRoutine = (void(__fastcall *)(void *))a3;
        LODWORD(Pool2[1].Parameter) = v5;
        HIDWORD(Pool2[1].Parameter) = v6;
        ExQueueWorkItem(Pool2, DelayedWorkQueue);
      }
      else
      {
        ExFreePoolWithTag(Pool2, 0);
      }
    }
    LODWORD(v12) = 0;
    wil_details_FeatureReporting_ReportUsageToService(
      (wil_details_FeatureReportingCache *)&WheapErrorSourceTable + 115,
      0x178806Fui64,
      0i64,
      0i64,
      (FEATURE_LOGGED_TRAITS *)&Feature_PdttSupport_logged_traits,
      v12);
  }
  return result;
}

Referenced by:

KeVerifyContextIpForUserCet