KiPreprocessFault

VOID __fastcall KiPreprocessFault(
        _EXCEPTION_RECORD *ExceptionRecord,
        _KEXCEPTION_FRAME *ExceptionFrame,
        _KTRAP_FRAME *TrapFrame,
        _CONTEXT *ContextRecord,
        CHAR PreviousMode){
  char v6; 
  INT64 v8; 
  __int16 High; 
  NTSTATUS(__stdcall *v10)(); 
  void *v11; 
  bool v12; 
  unsigned int v13; 
  NTSTATUS v14; 
  INT64 v15; 
  unsigned __int16 v16; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v18; 
  unsigned __int16 SListFaultCount; 
  INT64 v20[14]; 

  v6 = (char)TrapFrame;
  memset(v20, 0i64, 0x68u);
  switch( ExceptionRecord->ExceptionCode )
  {
    case 0x10000001:
      v13 = 0x80000000;
      break;
    case 0x10000002:
      v13 = 0x40000000;
      ExceptionRecord->ExceptionCode = -1073741795;
      goto LABEL_10;
    case 0x10000003:
      v13 = 0x20000000;
      ExceptionRecord->ExceptionCode = -1073741676;
      goto LABEL_10;
    case 0x10000004:
      goto LABEL_5;
    case 0x10000006:
      if( (unsigned __int8)KiOpPreprocessSecureFault(ExceptionRecord, ExceptionFrame) )
        return;
LABEL_5:
      High = ExceptionFrame->_Xmm6.High;
      if( High == 16 )
      {
        v10 = ExpInterlockedPopEntrySListFault;
        v11 = &ExpInterlockedPopEntrySListResume;
      }
      else
      {
        if( High != 51 )
          goto LABEL_8;
        v10 = (NTSTATUS(__stdcall *)())KeUserPopEntrySListFault;
        v11 = (void *)KeUserPopEntrySListResume;
      }
      if( (NTSTATUS(__stdcall *)())ExceptionFrame->_Rbp == v10 )
      {
        if( High != 16 )
        {
          CurrentThread = (_ETHREAD *)KeGetCurrentThread();
          v18 = ExceptionRecord->ExceptionInformation[1];
          if( (void *)v18 == CurrentThread->Tcb.SListFaultAddress )
          {
            SListFaultCount = CurrentThread->Tcb.SListFaultCount;
            v8 = 1024i64;
            if( SListFaultCount > 0x400u )
            {
              CurrentThread->Tcb.SListFaultCount = 0;
              goto LABEL_8;
            }
            v16 = SListFaultCount + 1;
          }
          else
          {
            CurrentThread->Tcb.SListFaultAddress = (void *)v18;
            v16 = 0;
          }
          CurrentThread->Tcb.SListFaultCount = v16;
        }
        ExceptionFrame->_Rbp = (unsigned __int64)v11;
        return;
      }
LABEL_8:
      v12 = ExceptionRecord->NumberParameters < 2;
      v13 = 0x10000000;
      ExceptionRecord->ExceptionCode = -1073741819;
      if( !v12 && (ExceptionRecord->ExceptionInformation[0] & 8) != 0 )
      {
        if( !v6 )
          return;
        v13 = 0x8000000;
      }
      goto LABEL_10;
    case 0x10000007:
      v13 = 0x4000000;
      break;
    default:
      return;
  }
  ExceptionRecord->ExceptionCode = -1073741819;
LABEL_10:
  LOBYTE(v8) = v6;
  v14 = KiOpDecode((INT64)ExceptionRecord, (INT64)ExceptionFrame, v8, v13, v20);
  if( v14 < 0 )
  {
    v15 = 0i64;
  }
  else
  {
    v15 = v20[11];
    if( v20[11] )
      v14 = (*(__int64(__fastcall **)(INT64 *))(v20[11] + 16))(v20);
  }
  if( v14 < 0 || !v15 || !LOBYTE(v20[12]) )
  {
    if( v13 == 0x80000000 )
    {
      if( ExceptionRecord->ExceptionCode == -1073741819 && !BYTE1(v20[12]) )
      {
        ExceptionRecord->ExceptionInformation[1] = -1i64;
        ExceptionRecord->NumberParameters = 2;
        ExceptionRecord->ExceptionInformation[0] = 0i64;
      }
    }
    else if( v13 == 0x8000000 )
    {
      KiCheckForAtlThunk((INT64)v20);
    }
  }
}

Referenced by: