RtlLookupFunctionEntry

_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *__fastcall RtlLookupFunctionEntry(
        UINT64 ControlPc,
        UINT64 *ImageBase,
        _UNWIND_HISTORY_TABLE *HistoryTable){
  unsigned int GlobalHint; 
  unsigned int v7; 
  unsigned int *v8; 
  UINT64 v9; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *result; 
  unsigned int LocalHint; 
  unsigned int v12; 
  unsigned __int64 v13; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *FunctionEntry; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v15; 
  __int64 Count; 
  UINT64 v17; 
  UINT64 v18; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v19; 
  void *v20; 
  unsigned __int128 v21; 
  __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v25; 
  int v26; 
  int i; 
  int v28; 
  UINT64 v29; 
  _INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo; 

  if( !HistoryTable )
    goto LABEL_29;
  if( HistoryTable->Once )
  {
    HistoryTable->Once = 0;
    result = *(_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)&RtlpUnwindHistoryTable[4 * (unsigned __int8)byte_140E01945 + 8];
    if( result )
    {
      v29 = *(_QWORD *)&RtlpUnwindHistoryTable[4 * (unsigned __int8)byte_140E01945 + 6];
      if( ControlPc >= v29 + result->BeginAddress && ControlPc < v29 + result->UnwindData )
      {
        *ImageBase = v29;
        return result;
      }
    }
  }
  if( !HistoryTable->Search )
    goto LABEL_29;
  if( ControlPc >= qword_140E01950
    || ControlPc < qword_140E01948
    || (GlobalHint = HistoryTable->GlobalHint, v7 = GlobalHint, GlobalHint >= RtlpUnwindHistoryTable[0]) )
  {
LABEL_11:
    if( ControlPc >= HistoryTable->LowAddress && ControlPc < HistoryTable->HighAddress )
    {
      LocalHint = HistoryTable->LocalHint;
      v12 = LocalHint;
      if( LocalHint < HistoryTable->Count )
      {
        while( 1 )
        {
          v13 = HistoryTable->Entry[v12].ImageBase;
          FunctionEntry = HistoryTable->Entry[v12].FunctionEntry;
          if( ControlPc >= v13 + FunctionEntry->BeginAddress && ControlPc < v13 + FunctionEntry->UnwindData )
            break;
          if( ++v12 >= HistoryTable->Count )
            goto LABEL_29;
        }
        HistoryTable->LocalHint = LocalHint + 1;
        *ImageBase = v13;
        LODWORD(result) = RtlpConvertFunctionEntry((INT64)FunctionEntry, v13);
        return result;
      }
    }
LABEL_29:
    memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
    if( ControlPc < (unsigned __int64)*(&byte_140E00020 + 1)
      || ControlPc >= (unsigned __int64)*(&byte_140E00020 + 1) + *((unsigned int *)&byte_140E00020 + 4) )
    {
      v19 = RtlpxLookupFunctionTable((VOID *)ControlPc, &FunctionTableInfo);
    }
    else
    {
      v19 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)byte_140E00020;
      FunctionTableInfo = *(_INVERTED_FUNCTION_TABLE_ENTRY *)&byte_140E00020;
    }
    v15 = 0i64;
    if( v19 )
    {
      v20 = FunctionTableInfo.ImageBase;
      v21 = FunctionTableInfo.SizeOfTable * (unsigned __int128)0xAAAAAAAAAAAAAAABui64;
      *ImageBase = (UINT64)FunctionTableInfo.ImageBase;
      v22 = *((_QWORD *)&v21 + 1) >> 3;
      if( (_DWORD)v22 )
      {
        v23 = ControlPc - (_QWORD)v20;
        v24 = *(&v19->BeginAddress + 3 * (unsigned int)(v22 - 1));
        v25 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v19 + 12 * (unsigned int)(v22 - 1));
        if( v23 < v24 )
        {
          v26 = v22 - 2;
          for( i = 0; v26 >= i; LODWORD(v24) = v25->BeginAddress )
          {
            v28 = (i + v26) >> 1;
            v25 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v19 + 12 * v28);
            if( v23 < v25->BeginAddress )
            {
              v26 = v28 - 1;
            }
            else
            {
              LODWORD(v24) = v25->BeginAddress;
              if( v23 < v25[1].UnwindData )
                break;
              i = v28 + 1;
            }
          }
        }
        if( v23 >= (unsigned int)v24 && v23 < v25->UnwindData )
          v15 = v25;
      }
      if( v15 )
      {
        if( HistoryTable )
        {
          if( !HistoryTable->Search )
          {
            Count = HistoryTable->Count;
            if( (unsigned int)Count < 0xC )
            {
              HistoryTable->Count = Count + 1;
              HistoryTable->Entry[Count].ImageBase = *ImageBase;
              HistoryTable->Entry[(unsigned int)Count].FunctionEntry = v15;
              v17 = *ImageBase + v15->BeginAddress;
              v18 = *ImageBase + v15->UnwindData;
              if( v17 < HistoryTable->LowAddress )
                HistoryTable->LowAddress = v17;
              if( v18 > HistoryTable->HighAddress )
                HistoryTable->HighAddress = v18;
            }
          }
        }
      }
    }
    LODWORD(result) = RtlpConvertFunctionEntry((INT64)v15, *ImageBase);
    return result;
  }
  while( 1 )
  {
    v8 = *(unsigned int **)&RtlpUnwindHistoryTable[4 * v7 + 8];
    v9 = *(_QWORD *)&RtlpUnwindHistoryTable[4 * v7 + 6];
    if( ControlPc >= v9 + *v8 && ControlPc < v9 + v8[1] )
      break;
    if( ++v7 >= RtlpUnwindHistoryTable[0] )
      goto LABEL_11;
  }
  result = *(_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)&RtlpUnwindHistoryTable[4 * v7 + 8];
  HistoryTable->GlobalHint = GlobalHint + 1;
  *ImageBase = v9;
  return result;
}

Referenced by:

KiInitDynamicTraceSupport
KiTpBuildExcludedKernelTracepointRangeList
MmWriteSystemImageTracepoint
RtlDispatchException
RtlInitializeHistoryTable
RtlRaiseException
RtlUnwindEx
RtlpSameFunction