KiDispatchException

VOID __stdcall KiDispatchException(
        _EXCEPTION_RECORD *ExceptionRecord,
        _KEXCEPTION_FRAME *ExceptionFrame,
        _KTRAP_FRAME *TrapFrame,
        CHAR PreviousMode,
        UINT8 FirstChance){
  CHAR P1Home; 
  unsigned __int64 P5; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  void *v11; 
  UINT64 v12; 
  int P1Home_high; 
  _KTRAP_FRAME *v14; 
  _CONTEXT *v15; 
  _CONTEXT *v16; 
  UINT64 v17; 
  unsigned __int64 High; 
  UINT8 IsThisAKdTrap; 
  int v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  _QWORD *P3Home; 
  __int64 v25; 
  UINT64 v26; 
  __int64 v27; 
  int ExceptionCode; 
  CHAR BugCheckParameter4; 
  _KEXCEPTION_FRAME a1; 
  __int64 v32; 
  P1Home = PreviousMode;
  LOWORD(a1.P1Home) = (unsigned __int8)PreviousMode;
  a1.P3Home = (unsigned __int64)ExceptionFrame;
  a1.Xmm7.High = (__int64)ExceptionRecord;
  a1.Xmm11.Low = (unsigned __int64)TrapFrame;
  a1.Spare1 = 0i64;
  LODWORD(a1.P4Home) = 0;
  memset((INT64)&a1.Xmm12.Low + 4, 0i64);
  *(_OWORD *)&a1.R15 = 0i64;
  v32 = 0i64;
  a1.Xmm6.High = (__int64)KeGetCurrentThread();
  P5 = *(_QWORD *)(a1.Xmm6.High + 184);
  a1.P5 = P5;
  __incgsdword(0x8030u);
  if( FirstChance && *(_QWORD *)(P5 + 2240) )
  {
    ExceptionCode = ExceptionRecord->ExceptionCode;
    switch( ExceptionRecord->ExceptionCode )
    {
      case 0x10000002:
        ExceptionRecord->ExceptionCode = -1073741795;
        break;
      case 0x10000003:
        ExceptionRecord->ExceptionCode = -1073741676;
        break;
      case 0x10000004:
        ExceptionRecord->ExceptionCode = -1073741819;
        break;
    }
    if( ObGetCurrentIrql() < 2u
      && (P1Home
       || (ExceptionRecord->ExceptionCode == -2147483647
        || (unsigned int)(ExceptionRecord->ExceptionCode + 1073741819) <= 1)
       && ExceptionRecord->ExceptionInformation[1] <= 0x7FFFFFFF0000i64) )
    {
      BugCheckParameter4 = P1Home;
      if( (unsigned __int8)((__int64(__fastcall *)(_EXCEPTION_RECORD *, unsigned __int64, _KTRAP_FRAME *, _QWORD))xmmword_140C1DE60)(
                              ExceptionRecord,
                              a1.P3Home,
                              TrapFrame,
                              0i64) )
        return;
    }
    ExceptionRecord->ExceptionCode = ExceptionCode;
    P5 = a1.P5;
  }
  HIDWORD(a1.P1Home) = 1048607;
  v9 = 0i64;
  if( P1Home )
  {
    if( (KeFeatureBits & 0x800000) != 0 )
    {
      HIDWORD(a1.P1Home) = 1048671;
      if( (KUSER_SHARED_DATA.XState.ControlFlags & 2) != 0 )
      {
        v9 = KUSER_SHARED_DATA.XState.EnabledFeatures | KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures;
        if( ((KUSER_SHARED_DATA.XState.EnabledFeatures | KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures) & 0x800) != 0
          && (*(_DWORD *)(P5 + 2516) & 0x4000) == 0 )
        {
          v9 &= ~0x800ui64;
        }
      }
    }
  }
  RtlGetExtendedContextLength2(HIDWORD(a1.P1Home), &a1.P4Home, v9);
  v10 = LODWORD(a1.P4Home) + 15i64;
  if( v10 <= LODWORD(a1.P4Home) )
    v10 = 0xFFFFFFFFFFFFFF0i64;
  v11 = alloca(v10 & 0xFFFFFFFFFFFFFFF0ui64);
  a1.Xmm10.High = (__int64)&a1;
  if( P1Home )
    memset((INT64)&a1, 0i64);
  v12 = v9;
  P1Home_high = HIDWORD(a1.P1Home);
  RtlInitializeExtendedContext2((INT64)&a1, HIDWORD(a1.P1Home), &a1.Spare1, v12);
  KeContextFromKframes(TrapFrame, (_KEXCEPTION_FRAME *)a1.P3Home, (_CONTEXT *)&a1);
  if( ExceptionRecord->ExceptionCode == -2147483645 )
  {
    --a1.Rbp;
    if( (KiDynamicTraceMask & 2) != 0 )
    {
      if( KiTpHandleTrap((INT64)ExceptionRecord, (INT64)&a1, P1Home, FirstChance) )
        goto LABEL_14;
    }
  }
  LOBYTE(v14) = P1Home;
  if( KiPreprocessFault(ExceptionRecord, &a1, v14, v15, BugCheckParameter4) )
    goto LABEL_14;
  if( !P1Home )
  {
    if( (!FirstChance
       || !KdTrap(TrapFrame, (KTRAP_FRAME *)a1.P3Home, ExceptionRecord, (CONTEXT *)&a1, 0, 0)
       && !RtlDispatchException(ExceptionRecord, (CONTEXT *)&a1))
      && !KdTrap(TrapFrame, (KTRAP_FRAME *)a1.P3Home, ExceptionRecord, (CONTEXT *)&a1, 0, 1u) )
    {
      KeBugCheckEx(
        0x1Eu,
        ExceptionRecord->ExceptionCode,
        (ULONG_PTR)ExceptionRecord->ExceptionAddress,
        ExceptionRecord->ExceptionInformation[0],
        ExceptionRecord->ExceptionInformation[1]);
    }
    goto LABEL_14;
  }
  High = a1.Xmm12.High;
  a1.Xmm7.Low = a1.Xmm12.High;
  if( (*(_DWORD *)(a1.P5 + 2172) & 1) == 0 )
  {
    if( *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1408i64)
      && ExceptionRecord->ExceptionCode == -2147483646
      && (TrapFrame->EFlags & 0x40000) != 0 )
    {
      _disable();
      TrapFrame->EFlags &= ~0x40000u;
      goto LABEL_75;
    }
    if( (a1.Xmm6.High & 0xFFF8) == 32 )
    {
      if( ExceptionRecord->ExceptionCode == -2147483645 )
      {
        ExceptionRecord->ExceptionCode = 1073741855;
      }
      else if( ExceptionRecord->ExceptionCode == -2147483644 )
      {
        ExceptionRecord->ExceptionCode = 1073741854;
      }
      High = (unsigned int)High & 0xFFFFFFF0;
      a1.Xmm7.Low = High;
    }
  }
  if( FirstChance )
  {
    LODWORD(a1.P5) = ExceptionRecord->ExceptionCode;
    IsThisAKdTrap = KdIsThisAKdTrap(ExceptionRecord, v16, a1.P5);
    BYTE1(a1.P1Home) = IsThisAKdTrap;
    if( !*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1400i64) && !KdIgnoreUmExceptions && v20 != -2147483597
      || IsThisAKdTrap )
    {
      if( KdTrap(TrapFrame, (KTRAP_FRAME *)a1.P3Home, ExceptionRecord, (CONTEXT *)&a1, a1.P1Home, 0) )
      {
        P1Home = a1.P1Home;
LABEL_14:
        KeContextToKframes(TrapFrame, (_KEXCEPTION_FRAME *)a1.P3Home, (_CONTEXT *)&a1, LODWORD(a1.Xmm6.Low), P1Home);
        if( !BYTE1(a1.P1Home) )
          return;
        _disable();
        KiSetupForInstrumentationReturn(TrapFrame, v17);
LABEL_75:
        _enable();
        return;
      }
      v20 = a1.P5;
    }
    if( v20 == -2147483597 || !DbgkForwardException(ExceptionRecord, 1u, 0) )
    {
      _disable();
      TrapFrame->EFlags &= ~0x100u;
      _enable();
      LODWORD(a1.Xmm12.Low) = -1073741819;
      LODWORD(a1.P2Home) = 0;
      v21 = High;
      a1.Xmm6.Low = High;
      if( (P1Home_high & 0x100040) == 1048640 )
      {
        v21 = (High - *(unsigned int *)(a1.Spare1 + 20)) & 0xFFFFFFFFFFFFFFC0ui64;
        a1.Xmm6.Low = v21;
      }
      a1.P3Home = (v21 - 40) & 0xFFFFFFFFFFFFFFF0ui64;
      a1.Xmm8.Low = a1.P3Home;
      a1.Xmm9.Low = a1.P3Home - 160;
      a1.Xmm9.High = a1.P3Home - 192;
      v22 = a1.P3Home - 1424;
      a1.Xmm8.High = a1.P3Home - 1424;
      LODWORD(a1.R15) = -1232;
      v23 = High - (a1.P3Home - 1424);
      HIDWORD(a1.R15) = High - (LODWORD(a1.P3Home) - 1424);
      a1.Return = 0x4D0FFFFFB30i64;
      LODWORD(v32) = v21 - (LODWORD(a1.P3Home) - 192);
      HIDWORD(v32) = High - v21;
      if( v23 - 1 > 0xFFE )
      {
        ProbeForWrite((VOID *)(a1.P3Home - 1424), High - (a1.P3Home - 1424), 0x10ui64);
        P3Home = (_QWORD *)a1.P3Home;
      }
      else
      {
        if( v22 >= 0x7FFFFFFF0000i64 )
          v22 = 0x7FFFFFFF0000i64;
        *(_BYTE *)v22 = *(_BYTE *)v22;
        *(_BYTE *)(v22 + v23 - 1) = *(_BYTE *)(v22 + v23 - 1);
        P3Home = (_QWORD *)a1.Xmm8.Low;
        v22 = a1.Xmm8.High;
      }
      P3Home[3] = High;
      *P3Home = a1.Rbp;
      KeCopyExceptionRecord(a1.Xmm9.Low, (INT64)ExceptionRecord);
      v25 = a1.Xmm9.High;
      RtlpCopyExtendedContext(1, a1.Xmm9.High, (INT64)&a1.R15, HIDWORD(a1.P1Home), a1.Spare1, 0i64);
      *(_OWORD *)v25 = *(_OWORD *)&a1.R15;
      *(_QWORD *)(v25 + 16) = v32;
      --*(_WORD *)(a1.Xmm6.High + 486);
      LODWORD(a1.P2Home) = 1;
      KePopulateContinuationContext(TrapFrame->Rip);
      TrapFrame->Rsp = v22;
      TrapFrame->SegCs = 51;
      TrapFrame->Rip = KeUserExceptionDispatcher;
      KiSetupForInstrumentationReturn(TrapFrame, v26);
      KiLeaveGuardedRegionUnsafe(v27);
      LODWORD(a1.P2Home) = 0;
    }
  }
  else if( !DbgkForwardException(ExceptionRecord, 1u, 1u) && !DbgkForwardException(ExceptionRecord, 0, 1u) )
  {
    ZwTerminateProcess((PVOID)0xFFFFFFFFFFFFFFFFi64, (unsigned int)ExceptionRecord->ExceptionCode);
  }
}

Referenced by: