RtlWalkFrameChain

NTSTATUS __fastcall RtlWalkFrameChain(INT64 a1, INT64 a2, UINT64 a3){
  unsigned int v4; 
  unsigned int v5; 
  unsigned int v6; 
  char v7; 
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  _KPROFILE_SOURCE v10; 
  UINT64 v11; 
  __int64 v12; 
  NTSTATUS result; 
  int v14; 
  __int64 HighLimit[5]; 
  UINT64 LowLimit; 

  if( (a3 & 0xFFFF00FC) != 0 )
    return 0;
  v4 = a3 & 3;
  if( (unsigned int)a3 >> 8 > 0xFE || (_DWORD)a2 == -1 )
    return 0;
  v14 = (a3 & 2) == 0;
  v5 = v14 + ((unsigned int)a3 >> 8);
  v6 = v14 + a2;
  KeAreInterruptsEnabled(a1, (_BYTE *)a2);
  if( !v7
    || KeGetCurrentIrql() >= 2u
    || (CurrentThread = (_ETHREAD *)KeGetCurrentThread(), (CurrentThread->SameThreadPassiveFlags & 2) != 0)
    || CurrentThread->Win32StartAddress == KiExecuteDpc
    || !MmPhysicalMemoryBlock
    || (v9 = *(_QWORD *)(*(_QWORD *)(*(&stru_140C4DB30 + 267)
                                   + 8i64 * CurrentThread->Tcb.ApcState.Process->Vm.Instance.PartitionId)
                       + 6848i64)) == 0
    || CurrentThread == *(_ETHREAD **)(v9 + 88) )
  {
    if( (v4 & 1) != 0 )
      return 0;
  }
  HighLimit[0] = 0i64;
  LowLimit = 0i64;
  if( !RtlpGetStackLimits(&LowLimit, (UINT64 *)HighLimit) )
    return 0;
  LODWORD(v12) = KeGetCurrentStackPointer(v11, v10);
  if( v12 - LowLimit < 0xE30 )
    return 0;
  result = RtlpWalkFrameChain((VOID **)a1, v6, v4, v5);
  if( result )
    result -= v14;
  return result;
}

Referenced by: