RtlpLookupUserFunctionTableInverted

_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *__fastcall RtlpLookupUserFunctionTableInverted(
        VOID *ControlPc,
        _INVERTED_FUNCTION_TABLE_ENTRY *FunctionTableInfo,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        UINT64 a6,
        UINT64 a7,
        CHAR *a8){
  __int64 v10; 
  unsigned __int64 v11; 
  int v12; 
  int v13; 
  int v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v17; 
  __int64 SizeOfTable; 
  char *ImageBase; 
  int v21[8]; 
  int v22; 
  int v23; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v24; 
  int v25; 
  v25 = *(_DWORD *)(KeUserInvertedFunctionTable + 8);
  v22 = 0;
  v23 = 0;
  v10 = KeUserInvertedFunctionTable + 16;
  v11 = *(_QWORD *)(KeUserInvertedFunctionTable + 24);
  if( (unsigned __int64)ControlPc < v11
    || (unsigned __int64)ControlPc >= v11 + *(unsigned int *)(KeUserInvertedFunctionTable + 32) )
  {
    v12 = *(_DWORD *)KeUserInvertedFunctionTable - 1;
    if( (unsigned int)v12 <= 0x200 && *(_DWORD *)KeUserInvertedFunctionTable != 1 )
    {
      v13 = 1;
      v23 = 1;
      v22 = v12;
      while( v12 >= v13 )
      {
        v14 = (v13 + v12) >> 1;
        v10 = KeUserInvertedFunctionTable + 24i64 * v14 + 16;
        v15 = *(_QWORD *)(KeUserInvertedFunctionTable + 24i64 * v14 + 24);
        v16 = v15 + *(unsigned int *)(KeUserInvertedFunctionTable + 24i64 * v14 + 32);
        if( v16 < v15 )
          break;
        if( (unsigned __int64)ControlPc < v15 )
        {
          if( !v14 )
            return 0i64;
          v12 = v14 - 1;
          v22 = v14 - 1;
        }
        else
        {
          if( (unsigned __int64)ControlPc < v16 )
            goto LABEL_13;
          v13 = v14 + 1;
          v23 = v14 + 1;
        }
      }
    }
    return 0i64;
  }
LABEL_13:
  if( !v10 )
    return 0i64;
  v17 = *(_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)v10;
  v24 = v17;
  FunctionTableInfo->FunctionTable = (_IMAGE_RUNTIME_FUNCTION_ENTRY *)v17;
  FunctionTableInfo->ImageBase = *(void **)(v10 + 8);
  FunctionTableInfo->SizeOfTable = *(_DWORD *)(v10 + 20);
  FunctionTableInfo->SizeOfImage = *(_DWORD *)(v10 + 16);
  SizeOfTable = FunctionTableInfo->SizeOfTable;
  if( (_DWORD)SizeOfTable )
  {
    if( ((unsigned __int8)v17 & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)v17 + SizeOfTable > 0x7FFFFFFF0000i64
      || (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v17 + SizeOfTable) < v17 )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  ImageBase = (char *)FunctionTableInfo->ImageBase;
  if( (_WORD)ImageBase )
    ExRaiseDatatypeMisalignment();
  if( (unsigned __int64)(ImageBase + 64) > 0x7FFFFFFF0000i64 || ImageBase + 64 < ImageBase )
    MEMORY[0x7FFFFFFF0000] = 0;
  _InterlockedOr(v21, 0);
  if( *(_DWORD *)(KeUserInvertedFunctionTable + 8) != v25 || (v25 & 1) != 0 )
    return 0i64;
  else
    return v24;
}

Referenced by: