KeQueryCurrentStackInformationEx

BOOL __fastcall KeQueryCurrentStackInformationEx(UINT64 a1, _DWORD *a2, CHAR **a3, UINT64 *a4){
  _DWORD *v6; 
  unsigned __int8 CurrentIrql; 
  CHAR *CurrentPrcb; 
  char v10; 
  _ETHREAD *CurrentThread; 
  char v12; 
  CHAR *v13; 
  CHAR *v14; 
  CHAR *v15; 
  UINT64 v16; 
  UINT64 v17; 
  UINT64 v19; 
  v6 = a2;
  if( !KiRecoveryInProgress && (KiBugCheckActive & 3) != 0 )
  {
    *a2 = 0;
    LODWORD(v13) = 1;
    *a4 = -1i64;
    *a3 = (CHAR *)0xFFFF800000000000i64;
    return(int)v13;
  }
  CurrentIrql = KeGetCurrentIrql();
  if( CurrentIrql >= 2u )
  {
    v13 = (CHAR *)*((_QWORD *)KeGetPcr() + 4331);
    v14 = v13 - 24576;
    if( a1 < (unsigned __int64)v13 && (unsigned __int64)v14 <= a1 )
    {
      *a2 = 6;
      *a4 = (UINT64)v13;
      LOBYTE(v13) = 1;
      *a3 = v14;
      return(int)v13;
    }
    v13 = (CHAR *)(*((_QWORD *)KeGetPcr() + 4117) + 80i64);
    v15 = v13 - 24576;
    if( a1 < (unsigned __int64)v13 && (unsigned __int64)v15 <= a1 )
    {
      *a2 = 10;
      *a4 = (UINT64)v13;
      LOBYTE(v13) = 1;
      *a3 = v15;
      return(int)v13;
    }
  }
  else
  {
    KeAreInterruptsEnabled(a1, a2);
    if( v10 )
      goto LABEL_5;
  }
  v13 = (CHAR *)(*((_QWORD *)KeGetPcr() + 4117) + 80i64);
  CurrentPrcb = v13 - 24576;
  if( a1 < (unsigned __int64)v13 && (unsigned __int64)CurrentPrcb <= a1 )
  {
    *v6 = 10;
    *a4 = (UINT64)v13;
    LOBYTE(v13) = 1;
    *a3 = CurrentPrcb;
    return(int)v13;
  }
LABEL_5:
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( *((_QWORD *)CurrentThread + 5) != *((_QWORD *)KeGetPcr() + 53) )
  {
    *v6 = 5;
    goto LABEL_37;
  }
  if( CurrentIrql < 2u )
  {
LABEL_7:
    KeAreInterruptsEnabled((CHAR)CurrentPrcb, a2);
    if( v12 && KeGetCurrentIrql() < 0xFu )
      goto LABEL_9;
    if( KiRspInIstStack(3ui64, a1) )
    {
      *v6 = 8;
    }
    else
    {
      if( !KiRspInIstStack(2ui64, v17) )
      {
LABEL_9:
        if( (*((_DWORD *)CurrentThread + 29) & 0x1000) != 0 )
        {
          *v6 = 2;
        }
        else if( *((_BYTE *)CurrentThread + 731) )
        {
          *v6 = 4;
        }
        else
        {
          *v6 = 3;
        }
        v19 = *((_QWORD *)CurrentThread + 7);
        v13 = (CHAR *)*((_QWORD *)CurrentThread + 6);
        *a4 = v19;
        *a3 = v13;
        if( (unsigned __int64)v13 > a1 || a1 >= *a4 )
        {
          LOBYTE(v13) = 0;
          return(int)v13;
        }
        goto LABEL_14;
      }
      *v6 = 9;
    }
    goto LABEL_37;
  }
  LODWORD(v13) = KeKernelStackSize;
  v16 = *((_QWORD *)KeGetPcr() + 1618) + 80i64;
  a2 = (_DWORD *)(v16 - (unsigned int)KeKernelStackSize);
  if( (unsigned __int64)a2 > a1 || a1 >= v16 )
  {
    CurrentPrcb = (CHAR *)KeGetCurrentPrcb();
    if( CurrentPrcb != (CHAR *)KiDebuggerOwner )
      goto LABEL_7;
    *v6 = 7;
LABEL_37:
    LODWORD(v13) = 0;
    *a4 = -1i64;
    *a3 = (CHAR *)0xFFFF800000000000i64;
    goto LABEL_14;
  }
  *v6 = 1;
  *a4 = v16;
  *a3 = (CHAR *)a2;
LABEL_14:
  LOBYTE(v13) = 1;
  return(int)v13;
}

Referenced by: