MiCheckForUserStackOverflow

NTSTATUS __stdcall MiCheckForUserStackOverflow(PVOID FaultingAddress){
  int v1; 
  char *v3; 
  _ETHREAD *CurrentThread; 
  char bf_0; 
  unsigned int *Teb; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  _DWORD *v10; 
  UINT64 v11; 
  char *v12; 
  NTSTATUS v13; 
  char *v14; 
  NTSTATUS result; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  unsigned __int64 v18; 
  __int64 v19; 
  UINT64 v20; 
  VOID *v21; 
  UINT64 AllocationType; 
  UINT64 Protect; 
  UINT64 RegionSize; 
  VOID *BaseAddress; 
  unsigned __int64 v26; 
  __int64 v27; 
  NTSTATUS v28; 
  UINT64 OldProtect; 

  RegionSize = 0i64;
  v28 = 0;
  LODWORD(OldProtect) = 0;
  v3 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  bf_0 = CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0;
  if( bf_0 < 0
    || ((unsigned __int8)~((unsigned __int8)CurrentThread->_bf_1 >> 6) & ((bf_0 & 3) == 0)) == 0
    || CurrentThread->Tcb.ApcStateIndex == 1 )
  {
    return -2147483647;
  }
  if( !v1 && (unsigned int)MiCheckShadowStackOverflow((UINT64)FaultingAddress, &v28) )
    return v28;
  Teb = (unsigned int *)CurrentThread->Tcb.Teb;
  v7 = *((_QWORD *)Teb + 1);
  v26 = v7;
  v27 = *((_QWORD *)Teb + 655);
  v8 = v27 & 0xFFFFFFFFFFFFF000ui64;
  v9 = (Teb[1490] + 4095i64) & 0xFFFFFFFFFFFFF000ui64;
  RegionSize = v9;
  v10 = Teb + 4;
  v11 = v9;
  if( v9 )
  {
    v11 = v9 + 4096;
    v9 = v11;
    RegionSize = v11;
  }
  if( v11 < 0x3000 )
  {
    v9 = 12288i64;
    RegionSize = 12288i64;
    v11 = 12288i64;
  }
  if( (unsigned __int64)FaultingAddress >= v7 || (unsigned __int64)FaultingAddress < v8 )
  {
    WoW64Process = CurrentThread->Tcb.ApcState.Process->WoW64Process;
    if( WoW64Process )
    {
      Machine = WoW64Process->Machine;
      if( Machine == 332 || Machine == 452 )
      {
        v3 = (char *)(Teb + 2048);
        if( ((unsigned __int8)Teb & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        v18 = Teb[2049];
        v26 = v18;
        v19 = Teb[2947];
        v27 = v19;
        v20 = Teb[3038];
        RegionSize = v20;
        v8 = v19 & 0xFFFFFFFFFFFFF000ui64;
        if( (unsigned __int64)FaultingAddress < v18 && (unsigned __int64)FaultingAddress >= v8 )
        {
          v9 = (v20 + 4095) & 0xFFFFFFFFFFFFF000ui64;
          v11 = v9;
          RegionSize = v9;
          if( v9 )
          {
            v9 += 4096i64;
            RegionSize = v9;
            v11 = v9;
          }
          if( v11 < 0x2000 )
          {
            v9 = 0x2000i64;
            RegionSize = 0x2000i64;
            v11 = 0x2000i64;
          }
          v10 = Teb + 2050;
          goto LABEL_12;
        }
      }
    }
    return -2147483647;
  }
LABEL_12:
  v12 = (char *)(((unsigned __int64)FaultingAddress & 0xFFFFFFFFFFFFF000ui64) - v11);
  BaseAddress = v12;
  if( (unsigned __int64)v12 <= v8 )
  {
    v21 = (VOID *)(v8 + 4096);
  }
  else
  {
    if( (CurrentThread->Tcb.ApcState.Process->Peb->NtGlobalFlag & 0x10000) != 0 )
    {
      v13 = -1073741523;
    }
    else
    {
      LODWORD(Protect) = 260;
      LODWORD(AllocationType) = 4096;
      v13 = ZwAllocateVirtualMemory(
              (VOID *)0xFFFFFFFFFFFFFFFFi64,
              &BaseAddress,
              0i64,
              &RegionSize,
              AllocationType,
              Protect);
      v12 = (char *)BaseAddress;
      v9 = RegionSize;
    }
    if( v13 >= 0 )
    {
      v14 = &v12[v9];
      result = 275;
      goto LABEL_17;
    }
    RegionSize = v9 - 4096;
    v21 = v12 + 4096;
  }
  BaseAddress = v21;
  ZwProtectVirtualMemory((VOID *)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, &RegionSize, 4ui64, &OldProtect);
  v14 = (char *)BaseAddress;
  result = -1073741571;
LABEL_17:
  if( v3 )
    *v10 = (_DWORD)v14;
  else
    *(_QWORD *)v10 = v14;
  return result;
}

Referenced by: