RtlDispatchException

UINT8 __stdcall RtlDispatchException(EXCEPTION_RECORD *ExceptionRecord, CONTEXT *ContextRecord){
  UINT8 v4; 
  unsigned int v5; 
  unsigned __int64 Rsp; 
  int v7; 
  unsigned __int64 v8; 
  void *v9; 
  void *Rip; 
  UNWIND_HISTORY_TABLE *p_HistoryTable; 
  UINT64 *v12; 
  unsigned __int64 v13; 
  INT64 v14; 
  INT64 v15; 
  INT64 v16; 
  UINT64 v17; 
  int v18; 
  int v19; 
  bool v20; 
  INT64 v21; 
  PVOID v22; 
  INT64 v23; 
  INT64 v24; 
  int v25; 
  int v26; 
  int v27; 
  INT64 v28; 
  __int64 v29; 
  UINT64 v30; 
  char v31; 
  int v32; 
  INT64 v33; 
  bool IsFrameInBounds; 
  __int128 a2; 
  INT64 v37; 
  UINT64 HighLimit; 
  UINT64 LowLimit; 
  INT64 a3; 
  unsigned __int64 ImageBase; 
  PVOID v42; 
  unsigned __int64 v43; 
  INT64 a1; 
  DWORD64 ControlPc; 
  unsigned __int64 v46; 
  UINT64 *v47; 
  UINT64 StackFrame; 
  CONTEXT *Source; 
  INT64 v50; 
  PVOID v51; 
  UNWIND_HISTORY_TABLE *v52; 
  DWORD64 *v53; 
  INT64 v54; 
  struct _UNWIND_HISTORY_TABLE HistoryTable; 
  v54 = (INT64)ContextRecord;
  a1 = (INT64)ExceptionRecord;
  HIDWORD(a2) = 0;
  v4 = 0;
  memset((INT64)&ControlPc, 0i64);
  BYTE8(a2) = 0;
  v37 = 0i64;
  v42 = 0i64;
  HighLimit = 0i64;
  ImageBase = 0i64;
  LowLimit = 0i64;
  DWORD1(a2) = 0;
  memset((INT64)HistoryTable.Entry, 0i64);
  if( (NtGlobalFlag & 0x800000) != 0 )
  {
    BYTE8(a2) = 1;
    RtlpLogExceptionDispatch(ExceptionRecord, ContextRecord);
  }
  v5 = ExceptionRecord->ExceptionFlags & 1;
  LODWORD(a2) = v5;
  KeQueryCurrentStackInformation((_KERNEL_STACK_LIMITS *)&a2 + 1, &LowLimit, &HighLimit);
  Rsp = ContextRecord->Rsp;
  v7 = DWORD1(a2) == 10;
  DWORD1(a2) = v7;
  if( !RtlpGetStackLimitsEx(Rsp, (CHAR **)&LowLimit, &HighLimit) )
  {
    ExceptionRecord->ExceptionFlags = v5 | 8;
    return v4;
  }
  RtlGetExtendedContextLength2(0x10000Bui64, (_DWORD *)&a2 + 3, 0i64);
  v8 = HIDWORD(a2) + 15i64;
  if( v8 <= HIDWORD(a2) )
    v8 = 0xFFFFFFFFFFFFFF0i64;
  v9 = alloca(v8 & 0xFFFFFFFFFFFFFFF0ui64);
  RtlInitializeExtendedContext2((INT64)&a2, 1048587i64, &a3, 0i64);
  RtlpCopyContext((CONTEXT *)&a2, ContextRecord);
  Rip = (void *)ContextRecord->Rip;
  v43 = 0i64;
  p_HistoryTable = &HistoryTable;
  HistoryTable.Count = 0;
  HistoryTable.HighAddress = 0i64;
  *(_DWORD *)&HistoryTable.LocalHint = 0x1000000;
  HistoryTable.LowAddress = -1i64;
  while( 1 )
  {
    v12 = RtlLookupFunctionEntry(Rip, &ImageBase, p_HistoryTable);
    if( !v12 )
    {
      if( Rip == (void *)*v53 )
        goto LABEL_52;
      HistoryTable.Entry[3].ImageBase = *v53++;
      RtlpPopUserShadowStack((INT64)&a2);
      goto LABEL_11;
    }
    v13 = ImageBase;
    v14 = RtlVirtualUnwind(1i64, ImageBase, (UINT64)Rip);
    v15 = v37;
    v16 = v14;
    if( !RtlpIsFrameInBounds(&LowLimit, v37, &HighLimit) )
    {
      if( BYTE4(a2) == 1 )
      {
        BYTE4(a2) = 2;
        RtlpGetStackLimitsEx(v15, (CHAR **)&LowLimit, &HighLimit);
        v15 = v37;
      }
      else if( !BYTE4(a2) )
      {
        v32 = a2 | 8;
LABEL_53:
        v4 = 0;
        *(_DWORD *)(a1 + 4) = v32;
        return v4;
      }
    }
    if( v16 )
      break;
LABEL_10:
    v7 = DWORD1(a2);
LABEL_11:
    v17 = (UINT64)v53;
    Rip = (void *)HistoryTable.Entry[3].ImageBase;
    if( !RtlpIsFrameInBounds(&LowLimit, (UINT64)v53, &HighLimit) )
    {
      if( (_BYTE)v7 != 1
        || (LOBYTE(v7) = 0, DWORD1(a2) = v7, !RtlpGetStackLimitsEx(v17, (CHAR **)&LowLimit, &HighLimit)) )
      {
LABEL_52:
        v32 = a2;
        goto LABEL_53;
      }
    }
  }
  v18 = a2;
  v19 = 0;
  HIDWORD(a2) = 0;
  while( 1 )
  {
    v20 = BYTE8(a2) == 0;
    v21 = a1;
    v22 = v42;
    BYTE9(a2) = 0;
    ControlPc = (DWORD64)Rip;
    *(_DWORD *)(a1 + 4) = v18;
    v46 = v13;
    v47 = v12;
    StackFrame = v15;
    Source = (CONTEXT *)&a2;
    v50 = v16;
    v51 = v22;
    v52 = p_HistoryTable;
    LODWORD(v53) = v19;
    a3 = 0i64;
    if( !v20 )
    {
      v33 = RtlpLogExceptionHandler(v21, &a2, (INT64)Rip, v16);
      v15 = v37;
      a3 = v33;
    }
    v23 = v15;
    v24 = a1;
    v25 = RtlpExecuteHandlerForException(a1, v23, v54, (INT64)&ControlPc);
    if( a3 )
      *(_DWORD *)(a3 + 1396) = v25;
    v26 = *(_DWORD *)(v24 + 4) & 1;
    v15 = v37;
    v18 = v26 | a2;
    LODWORD(a2) = v26 | a2;
    if( v43 == v37 )
    {
      v18 &= ~0x10u;
      v43 = 0i64;
      LODWORD(a2) = v18;
    }
    if( v25 == 1 )
      goto LABEL_21;
    if( !v25 )
      break;
    v27 = v25 - 2;
    if( v27 )
    {
      if( v27 != 1 )
        RtlRaiseStatus(-1073741786);
      Rip = (void *)ControlPc;
      ImageBase = v46;
      RtlpCopyContext((CONTEXT *)&a2, Source);
      a3 = RtlVirtualUnwind(1i64, v28, (UINT64)Rip);
      v37 = StackFrame;
      v12 = RtlLookupFunctionEntry(Rip, &ImageBase, p_HistoryTable);
      if( v12 != v47
        || (v13 = ImageBase, (int)RtlLookupExceptionHandler((__int64)v12, ImageBase, 2u, v29, &a3, &v42) < 0)
        || (v16 = a3, a3 != v50)
        || v42 != v51 )
      {
        __fastfail(0x27u);
      }
      v15 = v37;
      p_HistoryTable = v52;
      HIDWORD(a2) = (_DWORD)v53;
      BYTE9(a2) = 1;
      if( !RtlpIsFrameInBounds(&LowLimit, v37, &HighLimit) && BYTE4(a2) == 1 )
      {
        RtlpGetStackLimitsEx(v15, (CHAR **)&LowLimit, &HighLimit);
        v18 = a2;
        v15 = v37;
LABEL_45:
        BYTE4(a2) = 0;
        goto LABEL_22;
      }
      v18 = a2;
    }
    else
    {
      v30 = StackFrame;
      v18 |= 0x10u;
      v31 = 1;
      LODWORD(a2) = v18;
      if( BYTE4(a2) )
      {
        IsFrameInBounds = RtlpIsFrameInBounds(&LowLimit, StackFrame, &HighLimit);
        v18 = a2;
        v31 = IsFrameInBounds;
        v30 = StackFrame;
      }
      if( v30 > v43 || !v31 )
        v43 = v30;
    }
LABEL_21:
    if( BYTE4(a2) == 2 )
      goto LABEL_45;
LABEL_22:
    v19 = HIDWORD(a2);
    if( !BYTE9(a2) )
      goto LABEL_10;
  }
  if( (v18 & 1) != 0 )
    RtlRaiseStatus(-1073741787);
  return 1;
}

Referenced by: