VfUtilCaptureViolationKernelStack

NTSTATUS __stdcall VfUtilCaptureViolationKernelStack(PCONTEXT ContextRecord){
  _QWORD *v1; 
  void **v2; 
  _QWORD *v3; 
  char v5; 
  unsigned __int8 CurrentIrql; 
  _KPROFILE_SOURCE v7; 
  UINT64 v8; 
  __int64 v9; 
  UINT64 v10; 
  size_t v11; 
  void *retaddr; 
  _KERNEL_STACK_LIMITS Type; 
  UINT64 LowLimit; 
  UINT64 HighLimit; 

  v2 = &retaddr;
  LowLimit = 0i64;
  v3 = v1;
  HighLimit = 0i64;
  Type = BugcheckStackLimits;
  if( ContextRecord )
  {
    v5 = 1;
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(0xFui64);
    RtlCaptureContext(ContextRecord);
    if( !KeQueryCurrentStackInformation(&Type, &LowLimit, &HighLimit)
      || (unsigned int)Type <= MachineCheckStackLimits && (v8 = 929i64, _bittest((const int *)&v8, Type)) )
    {
      v5 = 0;
    }
    else
    {
      LODWORD(v9) = KeGetCurrentStackPointer(v8, v7);
      v10 = v9 - LowLimit;
      memset(&VfRuleViolationStackSavedArea, 0i64, 0x6000u);
      v11 = HighLimit - LowLimit;
      if( HighLimit - LowLimit > 0x6000 )
        v11 = 24576;
      memmove(&VfRuleViolationStackSavedArea, (const VOID *)LowLimit, v11);
      *v3 = &VfRuleViolationStackSavedArea;
      ContextRecord->_Rsp = (unsigned __int64)&VfRuleViolationStackSavedArea + v10;
    }
    LODWORD(v2) = KiIrqlFlags;
    __writecr8(CurrentIrql);
    LOBYTE(v2) = v5;
  }
  else
  {
    LOBYTE(v2) = 0;
  }
  return(int)v2;
}

Referenced by: