PspProcessDynamicEHContinuationTargets

INT64 __stdcall PspProcessDynamicEHContinuationTargets(PVOID BugCheckParameter1){
  _QWORD *v1; 
  unsigned __int16 v2; 
  unsigned int *v3; 
  unsigned int v4; 
  char v5; 
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  _QWORD *v8; 
  PVOID v10; 
  int v11; 
  unsigned int v12; 
  _QWORD *v13; 
  __int64 *v14; 
  __int64 v15; 
  __int64 **v16; 
  __int64 *v17; 
  UINT64 v18; 
  int v19; 
  unsigned int v21; 
  unsigned int v22; 
  _ETHREAD *v23; 
  struct _EX_RUNDOWN_REF *RunRef; 
  unsigned int *v25; 
  _KAPC_STATE ApcState; 
  v25 = v3;
  memset(&ApcState, 0, sizeof(ApcState));
  v4 = 0;
  v5 = 0;
  v6 = v2;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v8 = v1;
  v21 = 0;
  v23 = CurrentThread;
  v10 = (PVOID)*((_QWORD *)CurrentThread + 23);
  --*((_WORD *)CurrentThread + 242);
  RunRef = (struct _EX_RUNDOWN_REF *)((char *)BugCheckParameter1 + 1112);
  if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)BugCheckParameter1 + 139) )
  {
    v12 = 0;
    v22 = v6;
    v5 = 2;
    if( v6 )
    {
      v13 = v8;
      while( (*((_DWORD *)CurrentThread + 324) & 1) == 0 )
      {
        if( (*((_DWORD *)BugCheckParameter1 + 281) & 0x40000008) != 0 )
          goto LABEL_2;
        if( (unsigned __int64)(*v13 - 0x10000i64) > 0x7FFFFFFDFFFFi64 )
        {
          v11 = -1073741503;
          goto LABEL_38;
        }
        if( (v13[1] & 0xFFFFFFFFFFFFFFFEui64) != 0 )
        {
          v11 = -1073741811;
          goto LABEL_38;
        }
        ++v12;
        v13 += 2;
        if( v12 >= v6 )
          goto LABEL_10;
      }
      v11 = -1073741749;
    }
    else
    {
LABEL_10:
      if( BugCheckParameter1 != v10 )
      {
        KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
        v5 = 3;
      }
      v5 |= 4u;
      ExAcquirePushLockExclusiveEx((UINT64)BugCheckParameter1 + 2568, 0i64);
      if( v6 )
      {
        v14 = v8 + 1;
        while( (*((_DWORD *)CurrentThread + 324) & 1) == 0 )
        {
          if( (*((_DWORD *)BugCheckParameter1 + 281) & 0x40000008) != 0 )
          {
            v11 = -1073741558;
            goto LABEL_35;
          }
          v15 = *v14;
          v16 = (__int64 **)((char *)BugCheckParameter1 + 2560);
          if( (*v14 & 1) != 0 )
          {
            v11 = RtlAddDynamicEHContinuationTarget((unsigned __int64 *)BugCheckParameter1 + 320, *(v14 - 1));
          }
          else
          {
            v17 = *v16;
            if( !*v16 )
              goto LABEL_33;
            v18 = *(v14 - 1);
            do
            {
              v19 = MiHotPatchImageTreeCompare(v18, (INT64)v17);
              if( v19 >= 0 )
              {
                if( v19 <= 0 )
                  break;
                v17 = (__int64 *)v17[1];
              }
              else
              {
                v17 = (__int64 *)*v17;
              }
            }
            while( v17 );
            if( !v17 )
            {
LABEL_33:
              v11 = -1073741275;
LABEL_34:
              v4 = v21;
              goto LABEL_35;
            }
            RtlAvlRemoveNode((unsigned __int64 *)BugCheckParameter1 + 320, v17);
            ExFreePoolWithTag(v17, 0);
            v11 = 0;
          }
          if( v11 < 0 )
            goto LABEL_34;
          *v14 = v15 | 2;
          v14 += 2;
          v4 = v21 + 1;
          v21 = v4;
          if( v4 >= v22 )
            goto LABEL_45;
          CurrentThread = v23;
        }
        v11 = -1073741749;
      }
      else
      {
LABEL_45:
        v11 = 0;
      }
LABEL_35:
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)BugCheckParameter1 + 321, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter1 + 321);
      KeAbPostRelease((char *)BugCheckParameter1 + 2568);
    }
  }
  else
  {
LABEL_2:
    v11 = -1073741558;
  }
LABEL_38:
  if( (v5 & 1) != 0 )
    KiUnstackDetachProcess(&ApcState, 0i64);
  if( (v5 & 2) != 0 )
    ExReleaseRundownProtection(RunRef);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  *v25 = v4;
  return(unsigned int)v11;
}

Referenced by: