RtlpIsFrameInBoundsEx

NTSTATUS __stdcall RtlpIsFrameInBoundsEx(
        UINT64 *LowLimit,
        UINT64 StackFrame,
        UINT64 *HighLimit,
        _KERNEL_STACK_SEGMENT *LastSegment){
  void **StackBase; 
  int v9; 
  _ETHREAD *CurrentThread; 
  unsigned int v11; 
  char *v12; 
  UINT64 v13; 
  char v14; 
  char v15; 
  int v16; 
  unsigned __int64 StackLimit; 
  UINT64 HighLimita; 
  __int64 LowLimita[2]; 
  void *retaddr; 
  _KERNEL_STACK_LIMITS Type; 

  StackBase = &retaddr;
  HighLimita = 0i64;
  LowLimita[0] = 0i64;
  Type = BugcheckStackLimits;
  if( (StackFrame & 7) != 0 )
    goto LABEL_5;
  StackBase = (void **)*LowLimit;
  if( StackFrame >= *LowLimit && StackFrame < *HighLimit )
    goto LABEL_4;
  if( (unsigned __int64)StackBase < 0xFFFF800000000000ui64 )
    goto LABEL_5;
  KeQueryCurrentStackInformation(&Type, (UINT64 *)LowLimita, &HighLimita);
  LODWORD(StackBase) = Type;
  if( (unsigned int)Type <= MachineCheckStackLimits )
  {
    v9 = 929;
    if( _bittest(&v9, Type) )
      goto LABEL_5;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = Type;
  if( Type == DPCStackLimits )
  {
LABEL_16:
    v14 = 0;
    if( !LastSegment->StackBase )
    {
      KeGetNextKernelStackSegment(&CurrentThread->Tcb, LastSegment, 1u);
      v14 = v15;
    }
    if( v11 <= 0xA && (v16 = 1090, _bittest(&v16, v11)) && v14
      || KeGetNextKernelStackSegment(&CurrentThread->Tcb, LastSegment, 0) )
    {
      StackLimit = LastSegment->StackLimit;
      StackBase = (void **)LastSegment->StackBase;
      if( StackFrame >= StackLimit && StackFrame < (unsigned __int64)StackBase )
      {
        *LowLimit = StackLimit;
        *HighLimit = (UINT64)StackBase;
        goto LABEL_4;
      }
    }
LABEL_5:
    LOBYTE(StackBase) = 0;
    return(int)StackBase;
  }
  if( (KeGetPcr()->Prcb.DpcRequestSummary & 1) == 0
    || CurrentThread == KeGetCurrentPrcb()->IdleThread
    || (LODWORD(StackBase) = KeKernelStackSize,
        v12 = (char *)KeGetPcr()->Prcb.DpcStack + 80,
        v13 = (UINT64)&v12[-(unsigned int)KeKernelStackSize],
        v13 > StackFrame)
    || StackFrame >= (unsigned __int64)v12 )
  {
    v11 = Type;
    goto LABEL_16;
  }
  *HighLimit = (UINT64)v12;
  *LowLimit = v13;
LABEL_4:
  LOBYTE(StackBase) = 1;
  return(int)StackBase;
}

Referenced by: