KiVerifyContextIpForUserCet

INT64 __fastcall KiVerifyContextIpForUserCet(INT64 a1, INT64 a2, INT64 *r8_0, CHAR a4, UINT64 *a5){
  UINT64 v8; 
  __int64 i; 
  UINT64 v10; 
  int v11; 
  INT64 result; 
  int ImageBaseAndLoadConfig; 
  char v14; 
  INT64 a3[2]; 
  __int64 v16; 
  v8 = *(_QWORD *)(a2 + 248);
  if( v8 - 0x10000 > 0x7FFFFFFDFFFFi64 )
    return 3221227018i64;
  for( i = *(_QWORD *)(a1 + 40); (*(_BYTE *)(i + 8) & 1) != 0; i = *(_QWORD *)(i + 40) )
    ;
  if( v8 == *(_QWORD *)(i - 40) )
    return 0i64;
  v10 = *a5;
  v11 = *(_DWORD *)r8_0;
  if( v11 < 0 )
    return 3221225485i64;
  if( v11 > 1 )
  {
    if( v11 == 2 )
      return RtlVerifyUserUnwindTarget(v8, 2i64, 0i64);
    if( v11 != 3 )
      return 3221225485i64;
  }
  if( !v10 )
  {
    v10 = __readmsr(0x6A7u);
    if( !v10 )
      return 0i64;
  }
  if( !v11 && v8 == PspUserThreadStart )
  {
    *(_DWORD *)r8_0 = 1;
    v11 = 1;
  }
  *(_OWORD *)a3 = 0i64;
  v16 = 0i64;
  if( !v11 )
  {
    result = RtlVerifyUserUnwindTarget(v8, 0i64, (INT64)a3);
    if( (int)result >= 0 )
      return result;
  }
  if( a4 && *(_DWORD *)r8_0 != 1 )
  {
    if( (_BYTE)v16 )
      goto LABEL_25;
    ImageBaseAndLoadConfig = RtlGetImageBaseAndLoadConfig(v8, (PVOID *)a3, &a3[1]);
    v14 = v16;
    if( ImageBaseAndLoadConfig >= 0 )
      v14 = 1;
    LOBYTE(v16) = v14;
    if( v14 )
    {
LABEL_25:
      if( a3[0] )
      {
        if( (unsigned __int64)(a3[1] + 280) > 0x7FFFFFFF0000i64 || (unsigned __int64)(a3[1] + 280) < a3[1] )
          MEMORY[0x7FFFFFFF0000] = 0;
        if( a3[1] && *(_DWORD *)a3[1] >= 0x118u && (*(_DWORD *)(a3[1] + 144) & 0x400000) != 0 )
          goto LABEL_33;
        return 0i64;
      }
      return 0i64;
    }
  }
  do
  {
LABEL_33:
    if( *(_QWORD *)v10 == v8 )
    {
      *a5 = v10 + 8;
      return 0i64;
    }
    v10 += 8i64;
  }
  while( (v10 & 0xFFF) != 0 || (*(_DWORD *)(a1 + 1296) & 1) == 0 );
  return 3221225547i64;
}

Referenced by: