MiCheckForUserStackOverflow

NTSTATUS __stdcall MiCheckForUserStackOverflow(PVOID FaultingAddress){
  int v1; 
  __int64 v3; 
  _ETHREAD *CurrentThread; 
  char v5; 
  __int64 v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  _DWORD *v10; 
  ULONG_PTR v11; 
  char *v12; 
  NTSTATUS v13; 
  char *v14; 
  NTSTATUS result; 
  __int64 v16; 
  __int16 v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  ULONG_PTR v20; 
  void *v21; 
  UINT64 AllocationType; 
  UINT64 Protect; 
  ULONG_PTR RegionSize; 
  PVOID BaseAddress; 
  unsigned __int64 v26; 
  __int64 v27; 
  NTSTATUS v28; 
  UINT64 OldAccessProtection; 
  RegionSize = 0i64;
  v28 = 0;
  LODWORD(OldAccessProtection) = 0;
  v3 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = *((_BYTE *)CurrentThread + 1304);
  if( v5 < 0
    || ((unsigned __int8)~(*((_BYTE *)CurrentThread + 1305) >> 6) & ((v5 & 3) == 0)) == 0
    || *((_BYTE *)CurrentThread + 586) == 1 )
  {
    return -2147483647;
  }
  if( !v1 && (unsigned int)MiCheckShadowStackOverflow((UINT64)FaultingAddress, &v28) )
    return v28;
  v6 = *((_QWORD *)CurrentThread + 30);
  v7 = *(_QWORD *)(v6 + 8);
  v26 = v7;
  v27 = *(_QWORD *)(v6 + 5240);
  v8 = v27 & 0xFFFFFFFFFFFFF000ui64;
  v9 = (*(unsigned int *)(v6 + 5960) + 4095i64) & 0xFFFFFFFFFFFFF000ui64;
  RegionSize = v9;
  v10 = (_DWORD *)(v6 + 16);
  v11 = v9;
  if( v9 )
  {
    v11 = v9 + 4096;
    v9 = v11;
    RegionSize = v11;
  }
  if( v11 < 0x3000 )
  {
    v9 = 12288i64;
    RegionSize = 12288i64;
    v11 = 12288i64;
  }
  if( (unsigned __int64)FaultingAddress >= v7 || (unsigned __int64)FaultingAddress < v8 )
  {
    v16 = *(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1408i64);
    if( v16 )
    {
      v17 = *(_WORD *)(v16 + 8);
      if( v17 == 332 || v17 == 452 )
      {
        v3 = v6 + 0x2000;
        if( (v6 & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        v18 = *(unsigned int *)(v6 + 8196);
        v26 = v18;
        v19 = *(unsigned int *)(v6 + 11788);
        v27 = v19;
        v20 = *(unsigned int *)(v6 + 12152);
        RegionSize = v20;
        v8 = v19 & 0xFFFFFFFFFFFFF000ui64;
        if( (unsigned __int64)FaultingAddress < v18 && (unsigned __int64)FaultingAddress >= v8 )
        {
          v9 = (v20 + 4095) & 0xFFFFFFFFFFFFF000ui64;
          v11 = v9;
          RegionSize = v9;
          if( v9 )
          {
            v9 += 4096i64;
            RegionSize = v9;
            v11 = v9;
          }
          if( v11 < 0x2000 )
          {
            v9 = 0x2000i64;
            RegionSize = 0x2000i64;
            v11 = 0x2000i64;
          }
          v10 = (_DWORD *)(v6 + 8200);
          goto LABEL_12;
        }
      }
    }
    return -2147483647;
  }
LABEL_12:
  v12 = (char *)(((unsigned __int64)FaultingAddress & 0xFFFFFFFFFFFFF000ui64) - v11);
  BaseAddress = v12;
  if( (unsigned __int64)v12 <= v8 )
  {
    v21 = (void *)(v8 + 4096);
  }
  else
  {
    if( (*(_DWORD *)(*(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1360i64) + 188i64) & 0x10000) != 0 )
    {
      v13 = -1073741523;
    }
    else
    {
      LODWORD(Protect) = 260;
      LODWORD(AllocationType) = 4096;
      v13 = ZwAllocateVirtualMemory(
              (PVOID)0xFFFFFFFFFFFFFFFFi64,
              &BaseAddress,
              0i64,
              &RegionSize,
              AllocationType,
              Protect);
      v12 = (char *)BaseAddress;
      v9 = RegionSize;
    }
    if( v13 >= 0 )
    {
      v14 = &v12[v9];
      result = 275;
      goto LABEL_17;
    }
    RegionSize = v9 - 4096;
    v21 = v12 + 4096;
  }
  BaseAddress = v21;
  ZwProtectVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, &BaseAddress, &RegionSize, 4ui64, &OldAccessProtection);
  v14 = (char *)BaseAddress;
  result = -1073741571;
LABEL_17:
  if( v3 )
    *v10 = (_DWORD)v14;
  else
    *(_QWORD *)v10 = v14;
  return result;
}

Referenced by: