PspProcessDynamicEnforcedAddressRanges

INT64 __stdcall PspProcessDynamicEnforcedAddressRanges(_EPROCESS *PROCESS, INT64 a2){
  __int64 v2; 
  unsigned __int16 v3; 
  volatile INT64 *v4; 
  unsigned int v5; 
  char v6; 
  unsigned int v7; 
  __int64 v8; 
  struct _EX_RUNDOWN_REF *v10; 
  unsigned int v11; 
  unsigned int v12; 
  unsigned int v13; 
  bool v14; 
  _ETHREAD *v15; 
  _DWORD *v16; 
  unsigned __int64 v17; 
  __int64 v18; 
  int *v19; 
  int v20; 
  INT64 v21; 
  INT64 v22; 
  int v23; 
  unsigned int v25; 
  struct _EX_RUNDOWN_REF *v26; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v29; 
  struct _KAPC_STATE ApcState; 
  unsigned int *v31; 
  v4 = (volatile INT64 *)(a2 + 8);
  memset(&ApcState, 0, sizeof(ApcState));
  v5 = 0;
  v6 = 0;
  v7 = v3;
  v8 = v2;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v25 = 0;
  v29 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
  --*((_WORD *)CurrentThread + 242);
  v10 = (struct _EX_RUNDOWN_REF *)((char *)PROCESS + 1112);
  v26 = (struct _EX_RUNDOWN_REF *)((char *)PROCESS + 1112);
  if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)PROCESS + 139) )
  {
    v12 = 0;
    v13 = v7;
    v14 = v7 == 0;
    v6 = 2;
    v15 = CurrentThread;
    if( v14 )
    {
LABEL_13:
      if( PROCESS != v29 )
      {
        KeStackAttachProcess((PRKPROCESS)PROCESS, &ApcState);
        v6 = 3;
      }
      v6 |= 4u;
      ExAcquirePushLockExclusiveEx((UINT64)v4, 0i64);
      if( v13 )
      {
        v19 = (int *)(v8 + 16);
        while( 1 )
        {
          if( (*((_DWORD *)v15 + 324) & 1) != 0 )
          {
            v11 = -1073741749;
            goto LABEL_34;
          }
          if( (*((_DWORD *)PROCESS + 281) & 0x40000008) != 0 )
          {
            v11 = -1073741558;
            goto LABEL_34;
          }
          v20 = *v19;
          v21 = *((_QWORD *)v19 - 2);
          v22 = *((_QWORD *)v19 - 1);
          v23 = (*v19 & 1) != 0 ? RtlAddDynamicEnforcedAddressRange((RTL_BALANCED_NODE **)a2, v21, v22) : RtlRemoveDynamicEnforcedAddressRange((RTL_BALANCED_NODE **)a2, v21, v22);
          v11 = v23;
          if( v23 < 0 )
            break;
          *v19 = v20 | 2;
          v19 += 6;
          v5 = v25 + 1;
          v25 = v5;
          if( v5 >= v13 )
            goto LABEL_32;
          v15 = CurrentThread;
        }
        v5 = v25;
      }
      else
      {
LABEL_32:
        v11 = 0;
      }
LABEL_34:
      if( (_InterlockedExchangeAdd64(v4, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(v4);
      KeAbPostRelease((PVOID)v4);
    }
    else
    {
      v16 = (_DWORD *)(v8 + 16);
      while( (*((_DWORD *)CurrentThread + 324) & 1) == 0 )
      {
        if( (*((_DWORD *)PROCESS + 281) & 0x40000008) != 0 )
        {
          v11 = -1073741558;
          goto LABEL_37;
        }
        v17 = *((_QWORD *)v16 - 2);
        v18 = *((_QWORD *)v16 - 1);
        if( v18 + v17 < v17 )
        {
          v11 = -1073741675;
          goto LABEL_37;
        }
        if( v17 - 0x10000 > 0x7FFFFFFDFFFFi64 || v18 + v17 - 0x10000 > 0x7FFFFFFDFFFFi64 || !v18 )
        {
          v11 = -1073741503;
          goto LABEL_37;
        }
        if( (*v16 & 0xFFFFFFFE) != 0 )
        {
          v11 = -1073741811;
          goto LABEL_37;
        }
        ++v12;
        v16 += 6;
        if( v12 >= v13 )
          goto LABEL_13;
      }
      v11 = -1073741749;
    }
LABEL_37:
    v10 = v26;
  }
  else
  {
    v11 = -1073741558;
  }
  if( (v6 & 1) != 0 )
    KeUnstackDetachProcess(&ApcState);
  if( (v6 & 2) != 0 )
    ExReleaseRundownProtection(v10);
  KeLeaveCriticalRegion();
  *v31 = v5;
  return v11;
}

Referenced by: