RtlUnwindEx

NTSTATUS __stdcall RtlUnwindEx(
        PVOID TargetFrame,
        PVOID TargetPc,
        EXCEPTION_RECORD *ExceptionRecord,
        PVOID ReturnValue,
        CONTEXT *Context,
        UNWIND_HISTORY_TABLE *HistoryTable){
  CONTEXT *v6; 
  UNWIND_HISTORY_TABLE *v8; 
  char v10; 
  unsigned __int64 v11; 
  signed __int64 v12; 
  void *v13; 
  void *v14; 
  _KERNEL_STACK_LIMITS *v15; 
  INT64 v16; 
  INT64 v17; 
  INT64 v18; 
  void *v19; 
  _RUNTIME_FUNCTION *v20; 
  unsigned __int64 v21; 
  INT64 v22; 
  int v23; 
  _KERNEL_STACK_LIMITS v24; 
  PEXCEPTION_RECORD v25; 
  char v26; 
  int v27; 
  int v28; 
  CONTEXT *v29; 
  int v30; 
  char v31; 
  _KERNEL_STACK_LIMITS *v32; 
  PEXCEPTION_RECORD v33; 
  NTSTATUS v34; 
  CONTEXT *v35; 
  INT64 v36; 
  unsigned __int64 Rip; 
  unsigned __int64 *Rsp; 
  _KERNEL_STACK_LIMITS Type; 
  unsigned int a2; 
  INT64 v41; 
  CONTEXT *a3; 
  UINT64 LowLimit; 
  UINT64 HighLimit; 
  INT64 v45; 
  unsigned __int64 ImageBase; 
  PVOID v47; 
  PEXCEPTION_RECORD ExceptionRecorda; 
  UNWIND_HISTORY_TABLE *v49; 
  CONTEXT *Destination; 
  PVOID v51; 
  PVOID v52; 
  DWORD64 ControlPc; 
  unsigned __int64 v54; 
  PRUNTIME_FUNCTION FunctionEntry; 
  INT64 v56; 
  PVOID v57; 
  CONTEXT *Source; 
  INT64 v59; 
  PVOID v60; 
  UNWIND_HISTORY_TABLE *v61; 
  int v62; 
  CONTEXT *p_Type; 
  __int64 v64; 
  __int128 v65; 
  INT64 result[3]; 
  int v67; 
  v6 = Context;
  v8 = HistoryTable;
  v52 = TargetPc;
  ExceptionRecorda = ExceptionRecord;
  v51 = ReturnValue;
  Destination = Context;
  v49 = HistoryTable;
  memset((INT64)&ControlPc, 0i64);
  memset((INT64)result, 0i64);
  v47 = 0i64;
  HighLimit = 0i64;
  ImageBase = 0i64;
  a2 = 0;
  LowLimit = 0i64;
  Type = BugcheckStackLimits;
  KeQueryCurrentStackInformation(&Type, &LowLimit, &HighLimit);
  v10 = Type == ExceptionStackLimits;
  if( !RtlpGetStackLimits(&LowLimit, &HighLimit) )
LABEL_65:
    RtlRaiseStatus(-1073741784);
  RtlGetExtendedContextLength2(0x10000Bui64, &a2, 0i64);
  v11 = a2 + 15i64;
  if( v11 <= a2 )
    v11 = 0xFFFFFFFFFFFFFF0i64;
  v12 = v11 & 0xFFFFFFFFFFFFFFF0ui64;
  v13 = alloca(v12);
  v14 = alloca(v12);
  p_Type = (CONTEXT *)&Type;
  RtlInitializeExtendedContext2((INT64)&Type, 1048587i64, &a3, 0i64);
  a3 = (CONTEXT *)&Type;
  v15 = &Type;
  RtlCaptureContext2((INT64)Context, v16, v17, v18);
  if( HistoryTable )
    HistoryTable->Search = 1;
  if( !ExceptionRecord )
  {
    Rip = Context->Rip;
    ExceptionRecorda = (PEXCEPTION_RECORD)result;
    result[2] = Rip;
    LODWORD(result[0]) = -1073741785;
    result[1] = 0i64;
    v67 = 0;
  }
  Type = ExpandedStackLimits;
  if( !TargetFrame )
    Type = IsrStackLimits;
  v41 = 0i64;
  while( 1 )
  {
    v19 = (void *)v6->Rip;
    v20 = (_RUNTIME_FUNCTION *)RtlLookupFunctionEntry(v19, &ImageBase, v8);
    if( v20 )
    {
      RtlpCopyContext((CONTEXT *)v15, v6);
      v45 = 0i64;
      v64 = 0i64;
      v65 = 0i64;
      RtlpxVirtualUnwind(2, ImageBase, (unsigned __int64)v19, v20, v15, 0i64, &v47, &v41, &v45, &v64);
      v21 = v41;
      v22 = v45;
      if( (v41 & 7) != 0 || v41 < LowLimit || v41 >= HighLimit )
      {
        if( v10 != 1 )
          goto LABEL_65;
        v10 = 2;
        if( !RtlpGetStackLimitsEx(v41, (CHAR **)&LowLimit, &HighLimit) )
          goto LABEL_65;
        v21 = v41;
      }
      if( TargetFrame && !v10 && (unsigned __int64)TargetFrame < v21 )
        goto LABEL_65;
      if( v22 )
      {
        v23 = 0;
        v57 = v52;
        v24 = Type;
        a2 = 0;
        while( 1 )
        {
          if( TargetFrame == (PVOID)v21 )
          {
            v24 |= 0x20u;
            Type = v24;
          }
          v25 = ExceptionRecorda;
          v26 = 0;
          ExceptionRecorda->ExceptionFlags = v24;
          v6->Rax = (unsigned __int64)v51;
          v54 = ImageBase;
          v60 = v47;
          v61 = v49;
          ControlPc = (DWORD64)v19;
          FunctionEntry = v20;
          v56 = v41;
          Source = v6;
          v59 = v22;
          v62 = v23;
          if( (v6->ContextFlags & 0x100040) == 1048640 )
            v26 = 1;
          v27 = RtlpExecuteHandlerForUnwind((INT64)v25, v41, (INT64)v6, (INT64)&ControlPc);
          if( !v26 && (v6->ContextFlags & 0x100040) == 1048640 )
            v6->ContextFlags &= ~0x40u;
          Type &= 0xFFFFFF9F;
          v28 = v27 - 1;
          if( v28 )
          {
            if( v28 != 2 )
              RtlRaiseStatus(-1073741786);
            v19 = (void *)ControlPc;
            v20 = FunctionEntry;
            ImageBase = v54;
            RtlpCopyContext(Destination, Source);
            a3 = p_Type;
            v6 = v35;
            RtlpCopyContext(p_Type, v35);
            v22 = RtlVirtualUnwind(2i64, v36, (UINT64)v19);
            if( v22 != v59 || (v21 = v41, v41 != v56) || v47 != v60 )
              __fastfail(0x27u);
            Type |= 0x40u;
            v49 = v61;
            a2 = v62;
            if( RtlpIsFrameInBounds(&LowLimit, v41, &HighLimit) || v10 != 1 )
              goto LABEL_32;
            v10 = 2;
            RtlpGetStackLimitsEx(v21, (CHAR **)&LowLimit, &HighLimit);
          }
          else
          {
            if( (PVOID)v41 != TargetFrame )
            {
              v29 = v6;
              v6 = a3;
              a3 = v29;
            }
            v30 = _mm_getcsr();
            LODWORD(v45) = v30;
            v6->MxCsr = v30;
            v6->FltSave.MxCsr = v30;
          }
          v21 = v41;
LABEL_32:
          v24 = Type;
          v23 = a2;
          if( (Type & 0x40) == 0 )
            goto LABEL_33;
        }
      }
      if( (PVOID)v21 == TargetFrame )
      {
LABEL_33:
        v15 = (_KERNEL_STACK_LIMITS *)a3;
      }
      else
      {
        v32 = (_KERNEL_STACK_LIMITS *)v6;
        v6 = a3;
        v15 = v32;
        a3 = (CONTEXT *)v32;
      }
    }
    else
    {
      Rsp = (unsigned __int64 *)v6->Rsp;
      v6->Rip = *Rsp;
      v6->Rsp = (unsigned __int64)(Rsp + 1);
      RtlpPopUserShadowStack((INT64)v6);
      v21 = v41;
    }
    v31 = 0;
    if( v10 != 2 )
      v31 = v10;
    if( (v21 & 7) != 0 || v21 < LowLimit || v21 >= HighLimit )
      break;
    if( (PVOID)v21 == TargetFrame )
      goto LABEL_43;
    v8 = v49;
    v10 = v31;
  }
  if( (PVOID)v21 == TargetFrame )
  {
LABEL_43:
    v33 = ExceptionRecorda;
    v6->Rax = (unsigned __int64)v51;
    if( v33->ExceptionCode != -2147483607 )
    {
      v6->Rip = (unsigned __int64)v52;
      if( v33->ExceptionCode != -2147483610 )
        v33->ExceptionCode = -1073741785;
    }
    RtlGuardRestoreContext(v6, v33);
  }
  else
  {
    if( v19 == (void *)v6->Rip )
      RtlRaiseStatus(-1073741569);
    return ZwRaiseException(ExceptionRecorda, v6, 0);
  }
  return v34;
}

Referenced by: