HalpBlkMceFastForward
_EXCEPTION_REGISTRATION_RECORD *__fastcall HalpBlkMceFastForward(UINT64 a1, CHAR a2){
unsigned __int64 v2;
char v4;
unsigned __int64 v5;
unsigned __int64 v6;
unsigned __int64 v7;
__int64 v8;
_EXCEPTION_REGISTRATION_RECORD *result;
__int64 v10;
v2 = *(_QWORD *)(a1 + 384);
v4 = 0;
v5 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)KeGetPcr() + 64i64) + 52i64);
if( v2 <= v5 && v2 >= v5 - 0x2000 )
{
v4 = 1;
_InterlockedIncrement((volatile signed __int32 *)(*(_QWORD *)KeGetPcr() + 2424i64));
}
v6 = *(_QWORD *)(*(_QWORD *)(*(_QWORD *)KeGetPcr() + 64i64) + 44i64);
if( v2 <= v6 && v2 >= v6 - 0x2000 )
{
v4 |= 2u;
_InterlockedIncrement((volatile signed __int32 *)(*(_QWORD *)KeGetPcr() + 2428i64));
}
v7 = *(_QWORD *)(a1 + 360);
if( v7 >= (unsigned __int64)&HalpBlkMceExitMceTailMceBegin && v7 < (unsigned __int64)&HalpBlkMceExitMceTailMceEnd )
{
v4 |= 4u;
_InterlockedIncrement((volatile signed __int32 *)(*(_QWORD *)KeGetPcr() + 2432i64));
}
if( v7 >= (unsigned __int64)&HalpBlkMceExitMceTailNmiBegin && v7 < (unsigned __int64)HalpBlkMceExitMceTailNmiEnd )
{
v4 |= 4u;
_InterlockedIncrement((volatile signed __int32 *)(*(_QWORD *)KeGetPcr() + 2432i64));
}
v8 = *(_QWORD *)KeGetPcr();
if( !a2 && (v4 & 1) == 0 )
{
result = *(_EXCEPTION_REGISTRATION_RECORD **)KeGetPcr();
_InterlockedIncrement((volatile signed __int32 *)&result[153]);
LABEL_21:
v10 = 2264i64;
goto LABEL_23;
}
result = *(_EXCEPTION_REGISTRATION_RECORD **)KeGetPcr();
_InterlockedIncrement((volatile signed __int32 *)&result[152].Handler + 1);
if( (v4 & 1) != 0 )
{
result = *(_EXCEPTION_REGISTRATION_RECORD **)KeGetPcr();
_InterlockedIncrement((volatile signed __int32 *)&result[153].Handler + 1);
}
if( a2 )
{
if( (v4 & 1) != 0 )
HalpBlkFatalErrorHalt(2u, a1);
goto LABEL_21;
}
v10 = 2344i64;
LABEL_23:
if( (v4 & 4) != 0 )
{
_InterlockedIncrement((volatile signed __int32 *)(*(_QWORD *)KeGetPcr() + 2464i64));
*(_OWORD *)(a1 + 360) = *(_OWORD *)(v8 + v10);
*(_OWORD *)(a1 + 376) = *(_OWORD *)(v8 + v10 + 16);
*(_QWORD *)(a1 + 392) = *(_QWORD *)(v8 + v10 + 32);
*(_QWORD *)(a1 + 48) = *(_QWORD *)(v8 + v10 + 40);
*(_QWORD *)(a1 + 56) = *(_QWORD *)(v8 + v10 + 48);
*(_QWORD *)(a1 + 64) = *(_QWORD *)(v8 + v10 + 56);
result = *(_EXCEPTION_REGISTRATION_RECORD **)KeGetPcr();
_InterlockedIncrement((volatile signed __int32 *)&result[152].Handler);
*(_WORD *)(v8 + v10 + 8) = 0;
}
if( !a2 )
{
_InterlockedIncrement((volatile signed __int32 *)(*(_QWORD *)KeGetPcr() + 2436i64));
*(_OWORD *)(v8 + v10) = *(_OWORD *)(a1 + 360);
*(_OWORD *)(v8 + v10 + 16) = *(_OWORD *)(a1 + 376);
*(_QWORD *)(v8 + v10 + 32) = *(_QWORD *)(a1 + 392);
*(_QWORD *)(v8 + v10 + 40) = *(_QWORD *)(a1 + 48);
*(_QWORD *)(v8 + v10 + 48) = *(_QWORD *)(a1 + 56);
result = *(_EXCEPTION_REGISTRATION_RECORD **)(a1 + 64);
*(_QWORD *)(v8 + v10 + 56) = result;
}
return result;
}Referenced by:
HalpBlkMachineCheckAbort
HalpBlkNmiInterrupt