ObpStartRuntimeStackTrace

__int64 __fastcall ObpStartRuntimeStackTrace(__int64 a1){
  unsigned int inited; 
  int v3; 
  char PreviousMode; 
  int v5; 
  unsigned __int64 v6; 
  unsigned int i; 
  unsigned int j; 
  unsigned __int16 v9; 
  VOID **PoolWithTag; 
  _ETHREAD *CurrentThread; 
  wchar_t *v13; 
  wchar_t *Buffer; 
  char v15; 
  int v16; 
  _UNICODE_STRING P; 
  __int128 v18; 
  __int128 Src; 
  __int128 v20[4]; 

  memset(v20, 0i64, sizeof(v20));
  inited = 0;
  P = 0i64;
  v3 = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v15 = PreviousMode;
  v18 = *(_OWORD *)(a1 + 24);
  Src = *(_OWORD *)(a1 + 8);
  v5 = *(unsigned __int8 *)(a1 + 1);
  v16 = v5;
  if( (_WORD)v18 )
  {
    if( (*(_OWORD *)(a1 + 24) & 1) != 0
      || ((((unsigned __int64)(unsigned __int16)v18 >> 1) % 5) & 0xFFFFFFFFFFFFFFFBui64) != 0 )
    {
      return 3221225485i64;
    }
    v6 = ((unsigned __int64)(unsigned __int16)v18 + 2) / 0xA;
    if( (unsigned int)v6 > 0x10 )
      LODWORD(v6) = 16;
    if( PreviousMode )
    {
      if( (BYTE8(v18) & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)(unsigned __int16)v18 + *((_QWORD *)&v18 + 1) > 0x7FFFFFFF0000i64
        || (unsigned __int64)(unsigned __int16)v18 + *((_QWORD *)&v18 + 1) < *((_QWORD *)&v18 + 1) )
      {
        MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    for( i = 0; i < (unsigned int)v6; ++i )
    {
      for( j = 0; j < 4; ++j )
        *((_DWORD *)v20 + i) = (*((_DWORD *)v20 + i) << 8) | *(unsigned __int16 *)(*((_QWORD *)&v18 + 1)
                                                                                 + 2i64 * (5 * i - j + 3));
    }
    v3 = 16;
    v5 = v16;
  }
  if( (_WORD)Src )
  {
    if( (Src & 1) != 0 )
      return 3221225485i64;
    if( (unsigned __int16)Src >= 0x80u )
      v9 = 126;
    else
      v9 = Src;
    P.Length = v9;
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v9 + 2i64, 1951556175i64);
    P.Buffer = (wchar_t *)PoolWithTag;
    if( !PoolWithTag )
      return 3221225495i64;
    P.MaximumLength = v9 + 2;
    if( v15 )
    {
      if( (BYTE8(Src) & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      if( *((_QWORD *)&Src + 1) + (unsigned __int64)(unsigned __int16)Src > 0x7FFFFFFF0000i64
        || *((_QWORD *)&Src + 1) + (unsigned __int64)(unsigned __int16)Src < *((_QWORD *)&Src + 1) )
      {
        MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    memmove(PoolWithTag, *((const VOID **)&Src + 1), v9);
    *((_WORD *)PoolWithTag + ((unsigned __int64)v9 >> 1)) = 0;
    v3 |= 0x20u;
    inited = 0;
    v5 = v16;
  }
  if( !v3 )
    return 3221225485i64;
  if( v5 )
    v3 |= 0x40u;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&stru_140C25A40, 0i64);
  if( (ObpTraceFlags & 0x73) == 0 )
    inited = ObpInitStackAndObjectTables();
  if( (inited & 0x80000000) != 0 )
  {
    if( (_InterlockedExchangeAdd64(&stru_140C25A40._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C25A40);
    KeAbPostRelease(&stru_140C25A40);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    Buffer = P.Buffer;
    if( !P.Buffer )
      return inited;
  }
  else
  {
    v13 = stru_140C259D0.Buffer;
    stru_140C259D0 = P;
    *(_OWORD *)dword_140C25940 = v20[0];
    xmmword_140C25950 = v20[1];
    xmmword_140C25960 = v20[2];
    xmmword_140C25970 = v20[3];
    ObpTraceFlags = v3 | ObpTraceFlags & 0xFFFFFF8E | 2;
    dword_140C259F8 = ObpTraceFlags;
    qword_140C259F0 = (unsigned __int64)dword_140C25940 & -(__int64)((ObpTraceFlags & 0x10) != 0);
    qword_140C259C0 = (PCUNICODE_STRING)((unsigned __int64)&stru_140C259D0 & -(__int64)((ObpTraceFlags & 0x20) != 0));
    if( (_InterlockedExchangeAdd64(&stru_140C25A40._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C25A40);
    KeAbPostRelease(&stru_140C25A40);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    if( !v13 )
      return inited;
    Buffer = v13;
  }
  ExFreePoolWithTag(Buffer, 0x7452624Fu);
  return inited;
}

Referenced by: