KiSetupForInstrumentationReturn.asm

KiSetupForInstrumentationReturn proc near
                mov     rax, gs:188h    ; Get current thread
                mov     rdx, [rax+0B8h] ; Thread->Process
                mov     r8, [rdx+2C8h]  ; Process->Pcb.InstrumentationCallback
                test    r8, r8
                jnz     CallbackPresent

Exit:
                retn
                
CallbackPresent:
                cmp     [rcx+_KTRAP_FRAME.SegCs], 33h ; SegCs!
                jnz     Exit
                mov     rax, [rcx+_KTRAP_FRAME._Rip]  ; Saves Rip
                mov     [rcx+_KTRAP_FRAME._R10], rax  ; in _KTRAP_FRAME->R10
                mov     [rcx+_KTRAP_FRAME._Rip], r8   ; _KTRAP_FRAME->Rip = Callback
                retn
KiSetupForInstrumentationReturn endp