PspProcessDynamicEnforcedAddressRanges

NTSTATUS __fastcall PspProcessDynamicEnforcedAddressRanges(
        _EPROCESS *Process,
        _RTL_BALANCED_NODE **a2,
        INT64 a3,
        UINT16 a4,
        INT64 a5){
  _EX_PUSH_LOCK *v5; 
  unsigned int v6; 
  char v7; 
  unsigned int v8; 
  _EX_RUNDOWN_REF *p_RundownProtect; 
  NTSTATUS v12; 
  unsigned int v13; 
  unsigned int v14; 
  bool v15; 
  _ETHREAD *v16; 
  _DWORD *v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  int *v20; 
  int v21; 
  _RTL_BALANCED_NODE *v22; 
  _RTL_BALANCED_NODE *v23; 
  NTSTATUS v24; 
  unsigned int v26; 
  _EX_RUNDOWN_REF *v27; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v30; 
  _KAPC_STATE ApcState; 

  v5 = (_EX_PUSH_LOCK *)(a2 + 1);
  memset(&ApcState, 0, sizeof(ApcState));
  v6 = 0;
  v7 = 0;
  v8 = a4;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v26 = 0;
  v30 = CurrentThread->Tcb.ApcState.Process;
  --CurrentThread->Tcb.KernelApcDisable;
  p_RundownProtect = &Process->RundownProtect;
  v27 = &Process->RundownProtect;
  if( ExAcquireRundownProtection(&Process->RundownProtect) )
  {
    v13 = 0;
    v14 = v8;
    v15 = v8 == 0;
    v7 = 2;
    v16 = CurrentThread;
    if( v15 )
    {
LABEL_13:
      if( Process != v30 )
      {
        KeStackAttachProcess(&Process->Pcb, &ApcState);
        v7 = 3;
      }
      v7 |= 4u;
      ExAcquirePushLockExclusiveEx(v5, 0i64);
      if( v14 )
      {
        v20 = (int *)(a3 + 16);
        while( 1 )
        {
          if( (v16->CrossThreadFlags & 1) != 0 )
          {
            v12 = -1073741749;
            goto LABEL_34;
          }
          if( (Process->Flags & 0x40000008) != 0 )
          {
            v12 = -1073741558;
            goto LABEL_34;
          }
          v21 = *v20;
          v22 = (_RTL_BALANCED_NODE *)*((_QWORD *)v20 - 2);
          v23 = (_RTL_BALANCED_NODE *)*((_QWORD *)v20 - 1);
          v24 = (*v20 & 1) != 0 ? RtlAddDynamicEnforcedAddressRange(a2, v22, v23) : RtlRemoveDynamicEnforcedAddressRange(
                                                                                      a2,
                                                                                      (INT64)v22,
                                                                                      (INT64)v23);
          v12 = v24;
          if( v24 < 0 )
            break;
          *v20 = v21 | 2;
          v20 += 6;
          v6 = v26 + 1;
          v26 = v6;
          if( v6 >= v14 )
            goto LABEL_32;
          v16 = CurrentThread;
        }
        v6 = v26;
      }
      else
      {
LABEL_32:
        v12 = 0;
      }
LABEL_34:
      if( (_InterlockedExchangeAdd64(&v5->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v5);
      KeAbPostRelease(v5);
    }
    else
    {
      v17 = (_DWORD *)(a3 + 16);
      while( (CurrentThread->CrossThreadFlags & 1) == 0 )
      {
        if( (Process->Flags & 0x40000008) != 0 )
        {
          v12 = -1073741558;
          goto LABEL_37;
        }
        v18 = *((_QWORD *)v17 - 2);
        v19 = *((_QWORD *)v17 - 1);
        if( v19 + v18 < v18 )
        {
          v12 = -1073741675;
          goto LABEL_37;
        }
        if( v18 - 0x10000 > 0x7FFFFFFDFFFFi64 || v19 + v18 - 0x10000 > 0x7FFFFFFDFFFFi64 || !v19 )
        {
          v12 = -1073741503;
          goto LABEL_37;
        }
        if( (*v17 & 0xFFFFFFFE) != 0 )
        {
          v12 = -1073741811;
          goto LABEL_37;
        }
        ++v13;
        v17 += 6;
        if( v13 >= v14 )
          goto LABEL_13;
      }
      v12 = -1073741749;
    }
LABEL_37:
    p_RundownProtect = v27;
  }
  else
  {
    v12 = -1073741558;
  }
  if( (v7 & 1) != 0 )
    KeUnstackDetachProcess(&ApcState);
  if( (v7 & 2) != 0 )
    ExReleaseRundownProtection(p_RundownProtect);
  KeLeaveCriticalRegion();
  *(_DWORD *)a5 = v6;
  return v12;
}

Referenced by: