RtlpFindDynamicEHContinuationTarget
BOOL __fastcall RtlpFindDynamicEHContinuationTarget(UINT64 a1){
__int64 v2;
_ETHREAD *CurrentThread;
INT64 *v4;
_QWORD *v5;
int v6;
BOOL result;
v2 = *((_QWORD *)KeGetCurrentThread() + 23);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
v4 = (INT64 *)(v2 + 2568);
ExAcquirePushLockSharedEx(v2 + 2568, 0i64);
v5 = *(_QWORD **)(v2 + 2560);
while( v5 )
{
v6 = MiHotPatchImageTreeCompare(a1, (INT64)v5);
if( v6 >= 0 )
{
if( v6 <= 0 )
break;
v5 = (_QWORD *)v5[1];
}
else
{
v5 = (_QWORD *)*v5;
}
}
if( _InterlockedCompareExchange64(v4, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(v4);
KeAbPostRelease(v4);
KeLeaveCriticalRegion();
LOBYTE(result) = v5 != 0i64;
return result;
}Referenced by:
RtlVerifyUserUnwindTarget