RtlInsertDynamicFunctionTable

INT64 __fastcall RtlInsertDynamicFunctionTable(INT64 a1){
  unsigned __int64 v2; 
  unsigned __int64 v3; 
  unsigned int v4; 
  unsigned int v6; 
  UINT64 v7; 
  char *v8; 
  unsigned int v9; 
  unsigned int v10; 
  unsigned int v11; 
  unsigned __int64 *v12; 
  __int64 v13; 
  bool v14; 
  __int64 v15; 
  PVOID v16; 
  _ETHREAD *v17; 
  unsigned int SessionId; 
  char v19; 
  unsigned __int64 v20; 
  int v21; 
  __int64 v22; 
  __int64 v23; 
  int v24; 
  __int64 v25; 
  __int64 v26; 
  unsigned __int64 v27; 
  UINT8 *v28; 
  char *PoolWithQuotaTag; 
  UINT8 *v30; 
  int v31; 
  int v32; 
  unsigned __int64 v33; 
  unsigned __int64 v34; 
  __int64 v35; 
  _ETHREAD *CurrentThread; 
  int v37; 
  PVOID P; 
  if( (a1 & 3) != 0 )
    ExRaiseDatatypeMisalignment();
  v33 = *(_QWORD *)(a1 + 48);
  v2 = *(_QWORD *)(a1 + 40);
  v34 = v2;
  if( v2 < v33 )
    return 3221225621i64;
  v3 = v2 - v33;
  if( v3 > 0xFFFFFFFF )
    return 3221225621i64;
  v32 = v3;
  v4 = *(_DWORD *)(a1 + 84);
  if( v4 > 0x15555555 )
    return 3221225621i64;
  v31 = 12 * v4;
  P = 0i64;
  v6 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v35 = *((_QWORD *)CurrentThread + 68);
  --*((_WORD *)CurrentThread + 243);
  v7 = v35 + 2128;
  ExAcquirePushLockExclusiveEx(v35 + 2128, 0i64);
  v8 = *(char **)(v35 + 2120);
  if( v8 )
  {
    v9 = *(_DWORD *)v8;
    v10 = *((_DWORD *)v8 + 1);
  }
  else
  {
    v9 = 0;
    v10 = 0;
  }
  if( v9 + 1 <= v10 )
    goto LABEL_11;
  v26 = v10 + 10;
  if( (unsigned int)v26 < v10 || (v27 = 24 * v26 + 16, v27 >= 0xFFFFFFFF) )
  {
    v6 = -1073741675;
    goto LABEL_22;
  }
  v28 = *(UINT8 **)(v35 + 2120);
  P = v28;
  PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, (unsigned int)v27, 0x46447452ui64);
  v8 = PoolWithQuotaTag;
  if( PoolWithQuotaTag )
  {
    v30 = (UINT8 *)(PoolWithQuotaTag + 16);
    if( v9 )
    {
      memmove(v30, v28 + 16, 24i64 * v9);
    }
    else
    {
      *(_OWORD *)v30 = 0i64;
      *((_QWORD *)PoolWithQuotaTag + 4) = 0i64;
      v9 = 1;
    }
    *(_DWORD *)v8 = v9;
    *((_DWORD *)v8 + 1) = v26;
    v8[12] = 0;
    *(_QWORD *)(v35 + 2120) = v8;
LABEL_11:
    v11 = 1;
    if( v9 > 1 )
    {
      v12 = (unsigned __int64 *)(v8 + 48);
      do
      {
        if( v33 < *v12 )
          break;
        ++v11;
        v12 += 3;
      }
      while( v11 < v9 );
    }
    if( *(_QWORD *)&v8[24 * v11] + (unsigned __int64)*(unsigned int *)&v8[24 * v11 + 8] <= v33 )
    {
      v13 = v11;
      v14 = v11 == v9;
      if( v11 >= v9 )
      {
LABEL_19:
        if( !v14 )
          memmove((UINT8 *)&v8[16 * v11 + 40 + 8 * v11], (UINT8 *)&v8[16 * v11 + 16 + 8 * v11], 24i64 * (v9 - v11));
        v15 = 3 * v13;
        *(_QWORD *)&v8[8 * v15 + 16] = a1;
        *(_QWORD *)&v8[8 * v15 + 24] = v33;
        *(_DWORD *)&v8[8 * v15 + 32] = v32;
        *(_DWORD *)&v8[8 * v15 + 36] = v31;
        *(_DWORD *)v8 = v9 + 1;
        goto LABEL_22;
      }
      if( *(_QWORD *)&v8[24 * v11 + 24] >= v34 )
      {
        v14 = v11 == v9;
        goto LABEL_19;
      }
    }
    v6 = -1073741800;
LABEL_22:
    v16 = P;
    goto LABEL_23;
  }
  v6 = -1073741670;
  v16 = 0i64;
LABEL_23:
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v7, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)v7);
  v37 = 0;
  v17 = (_ETHREAD *)KeGetCurrentThread();
  if( (unsigned int)MiGetSystemRegionType(v7) == 1 )
    SessionId = MmGetSessionIdEx(*((_QWORD *)v17 + 23));
  else
    SessionId = -1;
  --*((_WORD *)v17 + 243);
  v19 = ++*((_BYTE *)v17 + 794);
  v20 = 0i64;
  v21 = (*((char *)v17 + 792) | *((char *)v17 + 870)) ^ 0x3F;
  while( 1 )
  {
    v14 = !_BitScanReverse((unsigned int *)&v22, v21);
    if( v14 )
      break;
    v21 &= ~(1 << v22);
    v23 = *((_QWORD *)v17 + 100) + 96 * v22;
    if( (*(_BYTE *)(v23 + 26) & 1) != 0
      && (*(_DWORD *)(v23 + 32) & 1) == 0
      && (*(_QWORD *)(v23 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v7 & 0x7FFFFFFFFFFFFFFCi64)
      && *(_DWORD *)(v23 + 40) == SessionId )
    {
      *(_BYTE *)(v23 + 26) &= ~1u;
      if( *(_QWORD *)(v23 + 32) )
      {
        v20 = v23;
        break;
      }
    }
  }
  if( v20 )
  {
    *(_BYTE *)(v20 + 32) |= 2u;
    if( *(__int64 *)(v20 + 32) < 0 )
      KiAbEntryRemoveFromTree(v20);
    v24 = *(_DWORD *)(v20 + 88);
    v37 = v24 & 0x1FFFF;
    *(_DWORD *)(v20 + 88) = v24 & 0xFFFE0000;
    *(_BYTE *)(v20 + 25) &= ~1u;
    *(_QWORD *)(v20 + 32) = 0i64;
    v25 = (__int64)(v20 - *((_QWORD *)v17 + 100)) / 96;
    if( v19 == 1 )
      *((_BYTE *)v17 + 792) |= 1 << v25;
    else
      _InterlockedOr8((volatile signed __int8 *)v17 + 870, 1 << v25);
  }
  else if( (*((_DWORD *)v17 + 30) & 0x10000) == 0 )
  {
    KeBugCheckEx(0x162u, (ULONG_PTR)v17, v7, SessionId, 0i64);
  }
  --*((_BYTE *)v17 + 794);
  KiAbThreadRemoveBoosts((ULONG_PTR)v17, v7, (unsigned int *)&v37);
  v14 = (*((_WORD *)v17 + 243))++ == 0xFFFF;
  if( v14 && *((_ETHREAD **)v17 + 19) != (_ETHREAD *)((char *)v17 + 152) )
    KiCheckForKernelApcDelivery();
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( v16 )
    ExFreePoolWithTag(v16, 0x46447452u);
  return v6;
}

Referenced by: