RtlpLogExceptionDispatch
VOID __stdcall RtlpLogExceptionDispatch(EXCEPTION_RECORD *ExceptionRecord, CONTEXT *ContextRecord){
unsigned int v3;
bool i;
signed __int32 v5;
int v6;
signed __int32 v7;
__int64 v8;
__int64 v9;
__int64 v10;
_OWORD *v11;
__int128 v12;
if( RtlpExceptionLog2 )
{
v3 = RtlpExceptionLogCount;
v6 = RtlpExceptionLogCount;
v5 = _InterlockedCompareExchange(&RtlpExceptionLogCount, (RtlpExceptionLogCount + 1) % 0x32u, RtlpExceptionLogCount);
for( i = v6 == v5; ; i = v5 == v7 )
{
v7 = v5;
if( i )
break;
v3 = v5;
v5 = _InterlockedCompareExchange(&RtlpExceptionLogCount, (v5 + 1) % 0x32u, v5);
}
v8 = 1424i64 * v3;
i = RtlpExceptionLog2 + v8 == 0;
v9 = RtlpExceptionLog2 + v8;
*(_QWORD *)(v9 + 1400) = KeGetCurrentThread();
if( !i )
{
*(_DWORD *)(v9 + 1392) = 1;
*(EXCEPTION_RECORD *)v9 = *ExceptionRecord;
v10 = 9i64;
v11 = (_OWORD *)(v9 + 160);
do
{
*v11 = *(_OWORD *)&ContextRecord->P1Home;
v11[1] = *(_OWORD *)&ContextRecord->P3Home;
v11[2] = *(_OWORD *)&ContextRecord->P5Home;
v11[3] = *(_OWORD *)&ContextRecord->ContextFlags;
v11[4] = *(_OWORD *)&ContextRecord->SegGs;
v11[5] = *(_OWORD *)&ContextRecord->Dr1;
v11[6] = *(_OWORD *)&ContextRecord->Dr3;
v11 += 8;
v12 = *(_OWORD *)&ContextRecord->Dr7;
ContextRecord = (CONTEXT *)((char *)ContextRecord + 128);
*(v11 - 1) = v12;
--v10;
}
while( v10 );
*v11 = *(_OWORD *)&ContextRecord->P1Home;
v11[1] = *(_OWORD *)&ContextRecord->P3Home;
v11[2] = *(_OWORD *)&ContextRecord->P5Home;
v11[3] = *(_OWORD *)&ContextRecord->ContextFlags;
v11[4] = *(_OWORD *)&ContextRecord->SegGs;
*(_DWORD *)(v9 + 208) &= 0x10001Fu;
}
}
}Referenced by:
RtlDispatchException