EmonPebsOverflowHandler

NTSTATUS __stdcall EmonPebsOverflowHandler(){
  __int64 v0; 
  __int64 **v1; 
  __int64 v2; 
  __int64 v3; 
  unsigned int v4; 
  unsigned __int64 v5; 
  __int64 v6; 

  LODWORD(v0) = KeGetPcr()->Prcb.Number;
  v1 = (__int64 **)*(&CmpDummyThreadEvent + 616);
  v2 = *(&CmpDummyThreadEvent + 614) + 160 * v0;
  while( v1 != (__int64 **)((char *)&CmpDummyThreadEvent + 4928) )
  {
    if( v1[3] )
    {
      if( *(&CmpDummyThreadEvent + 4920) )
      {
        v3 = *(_QWORD *)(v2 + 32);
        v4 = *(&CmpDummyThreadEvent + 1237);
        v5 = (*(_QWORD *)(v2 + 40) - v3) / (unsigned __int64)*(&CmpDummyThreadEvent + 1237);
      }
      else
      {
        v3 = *(unsigned int *)(v2 + 16);
        v4 = *(&CmpDummyThreadEvent + 1237);
        v5 = (unsigned int)(*(_DWORD *)(v2 + 20) - v3) / *(&CmpDummyThreadEvent + 1237);
      }
      ((void(__fastcall *)(__int64, _QWORD, unsigned __int64))v1[3])(v3, v4, v5);
      break;
    }
    v1 = (__int64 **)*v1;
  }
  if( *(&CmpDummyThreadEvent + 4920) )
  {
    v6 = *(_QWORD *)(v2 + 32);
    *(_QWORD *)(v2 + 40) = v6;
  }
  else
  {
    LODWORD(v6) = *(_DWORD *)(v2 + 16);
    *(_DWORD *)(v2 + 20) = v6;
  }
  return v6;
}

Referenced by: