RtlpLookupUserFunctionTable

UINT64 __stdcall RtlpLookupUserFunctionTable(PVOID EndingAddress, INT64 a2){
  INT64 v2; 
  INT64 v3; 
  IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v6; 
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  INT64 *v10; 
  _DWORD *v11; 
  int v12; 
  void *v13; 
  unsigned int v14; 
  int v15; 
  unsigned __int64 v16; 
  int v17; 
  unsigned int v18; 
  int v19; 
  int v20; 
  UINT64 v21; 
  IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v22; 
  __int64 v23; 
  unsigned __int64 v24; 
  IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *FunctionTable; 
  UINT64 a6[2]; 
  unsigned __int64 v27; 
  PVOID v28; 
  void *a2a; 
  __int64 v30[13]; 
  INT64 a4; 
  a2a = 0i64;
  LODWORD(a4) = 0;
  v30[0] = 0i64;
  v6 = RtlpLookupUserFunctionTableInverted(
         EndingAddress,
         (_INVERTED_FUNCTION_TABLE_ENTRY *)a2,
         v2,
         v3,
         (INT64)FunctionTable,
         0i64,
         0i64,
         0i64);
  FunctionTable = v6;
  if( !v6 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v9 = *((_QWORD *)CurrentThread + 68);
    if( *(_QWORD *)(v9 + 2120) )
    {
      --*((_WORD *)CurrentThread + 243);
      v10 = (INT64 *)(v9 + 2128);
      ExAcquirePushLockSharedEx(v9 + 2128, 0i64);
      v11 = *(_DWORD **)(v9 + 2120);
      if( v11 )
      {
        v12 = 1;
        if( *v11 != 1 )
        {
          if( (KiSpeculationFeatures & 0x2000000) != 0 )
          {
            v18 = dword_140C4C9F0;
            v19 = 4096;
          }
          else
          {
            v18 = 0;
            v19 = 0;
          }
          v20 = *v11 - 1;
          while( 1 )
          {
            while( 1 )
            {
              if( v20 < v12 )
                goto LABEL_6;
              v15 = (v12 + v20) >> 1;
              v28 = *(PVOID *)&v11[6 * v15 + 6];
              v16 = (unsigned __int64)v28 + (unsigned int)v11[6 * v15 + 8];
              if( EndingAddress >= v28 )
                break;
              if( !v15 )
                goto LABEL_6;
              v20 = v15 - 1;
            }
            if( (unsigned __int64)EndingAddress > 0x7FFFFFFEFFFFi64
              && v19
              && (unsigned __int64)EndingAddress >= v16 + v18
              && (unsigned __int64)EndingAddress < v16 + v19 + v18
              && v28 != (PVOID)PsNtosImageBase
              && v28 != PsHalImageBase )
            {
              break;
            }
            if( (unsigned __int64)EndingAddress < v16 )
            {
              *(_OWORD *)a6 = *(_OWORD *)&v11[6 * v15 + 4];
              v27 = *(_QWORD *)&v11[6 * v15 + 8];
              v19 = v27;
              v21 = a6[1];
              goto LABEL_40;
            }
            v12 = v15 + 1;
          }
          a6[0] = (UINT64)RtlRetpolineStubsFunctionTable;
          v21 = v16 + v18;
          a6[1] = v21;
          v27 = __PAIR64__(RtlRetpolineStubsFunctionTableSize, v19);
LABEL_40:
          *(_QWORD *)(a2 + 8) = v21;
          *(_DWORD *)(a2 + 16) = v19;
          if( _InterlockedCompareExchange64(v10, 0i64, 17i64) != 17 )
            ExfReleasePushLockShared(v10);
          KeAbPostRelease(v10);
          KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
          v22 = *(IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)(a6[0] + 16);
          FunctionTable = v22;
          *(_QWORD *)a2 = v22;
          v23 = (unsigned int)(12 * *(_DWORD *)(a6[0] + 84));
          *(_DWORD *)(a2 + 20) = v23;
          if( (_DWORD)v23 )
          {
            if( ((unsigned __int8)v22 & 3) != 0 )
              ExRaiseDatatypeMisalignment();
            v24 = (unsigned __int64)v22 + v23;
            if( v24 > 0x7FFFFFFF0000i64 || v24 < (unsigned __int64)v22 )
              MEMORY[0x7FFFFFFF0000] = 0;
          }
          return(UINT64)FunctionTable;
        }
      }
LABEL_6:
      if( _InterlockedCompareExchange64(v10, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v10);
      KeAbPostRelease(v10);
      KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    }
    if( (int)MmGetImageInformation((UINT64)EndingAddress, &a2a, v30, &a4) < 0 )
    {
      v13 = 0i64;
      v17 = 0;
      v6 = FunctionTable;
    }
    else
    {
      v13 = a2a;
      RtlCaptureImageExceptionValues(a2a, &FunctionTable, (UINT64 *)(a2 + 20));
      v6 = FunctionTable;
      if( FunctionTable )
      {
        v14 = *(_DWORD *)(a2 + 20);
        if( v14 && v14 == 12 * (v14 / 0xCui64) )
        {
          if( ((unsigned __int8)FunctionTable & 3) != 0 )
            ExRaiseDatatypeMisalignment();
          if( (unsigned __int64)FunctionTable + v14 > 0x7FFFFFFF0000i64
            || (IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)FunctionTable + v14) < FunctionTable )
          {
            MEMORY[0x7FFFFFFF0000] = 0;
          }
        }
        else
        {
          v6 = 0i64;
          FunctionTable = 0i64;
        }
      }
      v17 = v30[0];
    }
    *(_QWORD *)(a2 + 8) = v13;
    *(_DWORD *)(a2 + 16) = v17;
    *(_QWORD *)a2 = v6;
    if( !v6 )
      *(_DWORD *)(a2 + 20) = 0;
  }
  return(UINT64)v6;
}

Referenced by: