RtlWalkFrameChain

UINT64 __stdcall RtlWalkFrameChain(VOID **Callers, UINT64 Count, UINT64 Flags){
  unsigned int v4; 
  unsigned int v5; 
  unsigned int v6; 
  char v7; 
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  KPROFILE_SOURCE v10; 
  UINT64 v11; 
  __int64 v12; 
  UINT64 result; 
  BOOL v14; 
  __int64 HighLimit[5]; 
  UINT64 LowLimit; 
  if( (Flags & 0xFFFF00FC) != 0 )
    return 0i64;
  v4 = Flags & 3;
  if( (unsigned int)Flags >> 8 > 0xFE || (_DWORD)Count == -1 )
    return 0i64;
  v14 = (Flags & 2) == 0;
  v5 = v14 + ((unsigned int)Flags >> 8);
  v6 = v14 + Count;
  KeAreInterruptsEnabled((CHAR)Callers, (_BYTE *)Count);
  if( !v7
    || KeGetCurrentIrql() >= 2u
    || (CurrentThread = (_ETHREAD *)KeGetCurrentThread(), (*((_DWORD *)CurrentThread + 325) & 2) != 0)
    || *((VOID(__stdcall **)(PVOID))CurrentThread + 154) == KiExecuteDpc
    || !MmPhysicalMemoryBlock
    || (v9 = *(_QWORD *)(*(_QWORD *)(qword_140C4E388
                                   + 8i64 * *(unsigned __int16 *)(*((_QWORD *)CurrentThread + 23) + 1838i64))
                       + 6848i64)) == 0
    || CurrentThread == *(_ETHREAD **)(v9 + 88) )
  {
    if( (v4 & 1) != 0 )
      return 0i64;
  }
  HighLimit[0] = 0i64;
  LowLimit = 0i64;
  if( !RtlpGetStackLimits(&LowLimit, (UINT64 *)HighLimit) )
    return 0i64;
  LODWORD(v12) = KeGetCurrentStackPointer(v11, v10);
  if( v12 - LowLimit < 0xE30 )
    return 0i64;
  result = RtlpWalkFrameChain(Callers, v6, v4, v5);
  if( (_DWORD)result )
    return(unsigned int)(result - v14);
  return result;
}

Referenced by: