RtlInsertDynamicFunctionTable

NTSTATUS __stdcall RtlInsertDynamicFunctionTable(
        _DYNAMIC_FUNCTION_TABLE *DynamicTable,
        INT64 a2,
        INT64 r8_0,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  unsigned __int64 MaximumAddress; 
  unsigned __int64 v10; 
  unsigned int EntryCount; 
  NTSTATUS v13; 
  UINT64 v14; 
  char *bf_0; 
  unsigned int v16; 
  unsigned int v17; 
  unsigned int v18; 
  unsigned __int64 *v19; 
  __int64 v20; 
  bool v21; 
  __int64 v22; 
  PVOID v23; 
  _ETHREAD *v24; 
  unsigned int SessionId; 
  unsigned __int8 v26; 
  _KLOCK_ENTRY *v27; 
  int v28; 
  __int64 v29; 
  __int64 v30; 
  _KLOCK_ENTRY_BOOST_BITMAP v31; 
  __int64 v32; 
  __int64 v33; 
  unsigned __int64 v34; 
  __int64 v35; 
  char *PoolWithQuotaTag; 
  _OWORD *v37; 
  int v38; 
  int v39; 
  unsigned __int64 BaseAddress; 
  unsigned __int64 v41; 
  _EX_PUSH_LOCK *Process; 
  _ETHREAD *CurrentThread; 
  UINT64 a3; 
  PVOID P; 

  if( ((unsigned __int8)DynamicTable & 3) != 0 )
    ExRaiseDatatypeMisalignment();
  BaseAddress = DynamicTable->BaseAddress;
  MaximumAddress = DynamicTable->MaximumAddress;
  v41 = MaximumAddress;
  if( MaximumAddress < BaseAddress )
    return -1073741675;
  v10 = MaximumAddress - BaseAddress;
  if( v10 > 0xFFFFFFFF )
    return -1073741675;
  v39 = v10;
  EntryCount = DynamicTable->EntryCount;
  if( EntryCount > 0x15555555 )
    return -1073741675;
  v38 = 12 * EntryCount;
  P = 0i64;
  v13 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = (_EX_PUSH_LOCK *)CurrentThread->Tcb.Process;
  --CurrentThread->Tcb.SpecialApcDisable;
  v14 = (UINT64)&Process[266];
  ExAcquirePushLockExclusiveEx(Process + 266, 0i64);
  bf_0 = (char *)Process[265]._bf_0;
  if( bf_0 )
  {
    v16 = *(_DWORD *)bf_0;
    v17 = *((_DWORD *)bf_0 + 1);
  }
  else
  {
    v16 = 0;
    v17 = 0;
  }
  if( v16 + 1 <= v17 )
    goto LABEL_11;
  v33 = v17 + 10;
  if( (unsigned int)v33 < v17 || (v34 = 24 * v33 + 16, v34 >= 0xFFFFFFFF) )
  {
    v13 = -1073741675;
    goto LABEL_22;
  }
  v35 = Process[265]._bf_0;
  P = (PVOID)v35;
  PoolWithQuotaTag = (char *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, (unsigned int)v34, 0x46447452ui64);
  bf_0 = PoolWithQuotaTag;
  if( PoolWithQuotaTag )
  {
    v37 = PoolWithQuotaTag + 16;
    if( v16 )
    {
      memmove(v37, (const VOID *)(v35 + 16), 24 * v16);
    }
    else
    {
      *v37 = 0i64;
      *((_QWORD *)PoolWithQuotaTag + 4) = 0i64;
      v16 = 1;
    }
    *(_DWORD *)bf_0 = v16;
    *((_DWORD *)bf_0 + 1) = v33;
    bf_0[12] = 0;
    Process[265]._bf_0 = (__int64)bf_0;
LABEL_11:
    v18 = 1;
    if( v16 > 1 )
    {
      v19 = (unsigned __int64 *)(bf_0 + 48);
      do
      {
        if( BaseAddress < *v19 )
          break;
        ++v18;
        v19 += 3;
      }
      while( v18 < v16 );
    }
    if( *(_QWORD *)&bf_0[24 * v18] + (unsigned __int64)*(unsigned int *)&bf_0[24 * v18 + 8] <= BaseAddress )
    {
      v20 = v18;
      v21 = v18 == v16;
      if( v18 >= v16 )
      {
LABEL_19:
        if( !v21 )
          memmove(&bf_0[16 * v18 + 40 + 8 * v18], &bf_0[16 * v18 + 16 + 8 * v18], 24 * (v16 - v18));
        v22 = 3 * v20;
        *(_QWORD *)&bf_0[8 * v22 + 16] = DynamicTable;
        *(_QWORD *)&bf_0[8 * v22 + 24] = BaseAddress;
        *(_DWORD *)&bf_0[8 * v22 + 32] = v39;
        *(_DWORD *)&bf_0[8 * v22 + 36] = v38;
        *(_DWORD *)bf_0 = v16 + 1;
        goto LABEL_22;
      }
      if( *(_QWORD *)&bf_0[24 * v18 + 24] >= v41 )
      {
        v21 = v18 == v16;
        goto LABEL_19;
      }
    }
    v13 = -1073741800;
LABEL_22:
    v23 = P;
    goto LABEL_23;
  }
  v13 = -1073741670;
  v23 = 0i64;
LABEL_23:
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v14, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((_EX_PUSH_LOCK *)v14);
  LODWORD(a3) = 0;
  v24 = (_ETHREAD *)KeGetCurrentThread();
  if( MiGetSystemRegionType(v14) == 1 )
    SessionId = MmGetSessionIdEx(v24->Tcb.ApcState.Process);
  else
    SessionId = -1;
  --v24->Tcb.SpecialApcDisable;
  v26 = ++v24->Tcb.AbAllocationRegionCount;
  v27 = 0i64;
  v28 = ((char)v24->Tcb.AbEntrySummary | (char)v24->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
  while( 1 )
  {
    v21 = !_BitScanReverse((unsigned int *)&v29, v28);
    if( v21 )
      break;
    v28 &= ~(1 << v29);
    v30 = (__int64)&v24->Tcb.LockEntries[v29];
    if( (*(_BYTE *)(v30 + 26) & 1) != 0
      && (*(_DWORD *)(v30 + 32) & 1) == 0
      && (*(_QWORD *)(v30 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v14 & 0x7FFFFFFFFFFFFFFCi64)
      && *(_DWORD *)(v30 + 40) == SessionId )
    {
      *(_BYTE *)(v30 + 26) &= ~1u;
      if( *(_QWORD *)(v30 + 32) )
      {
        v27 = (_KLOCK_ENTRY *)v30;
        break;
      }
    }
  }
  if( v27 )
  {
    v27->CrossThreadReleasableAndBusyByte |= 2u;
    if( v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
      KiAbEntryRemoveFromTree(v27);
    v31.AllFields = (unsigned int)v27->BoostBitmap;
    LODWORD(a3) = v31.AllFields & 0x1FFFF;
    v27->BoostBitmap.AllFields = v31.AllFields & 0xFFFE0000;
    v27->ThreadLocalFlags &= ~1u;
    v27->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
    v32 = v27 - v24->Tcb.LockEntries;
    if( v26 == 1 )
      v24->Tcb.AbEntrySummary |= 1 << v32;
    else
      _InterlockedOr8((volatile signed __int8 *)&v24->Tcb.AbOrphanedEntrySummary, 1 << v32);
  }
  else if( (*(&v24->Tcb.MiscFlags + 1) & 0x10000) == 0 )
  {
    KeBugCheckEx(0x162u, v24, (PVOID)v14, (PVOID)SessionId, 0i64);
  }
  --v24->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v24->Tcb, (VOID *)v14, &a3);
  v21 = v24->Tcb.SpecialApcDisable++ == -1;
  if( v21 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v24->Tcb.ApcState.ApcListHead[0].Flink != &v24->Tcb.152 )
    KiCheckForKernelApcDelivery();
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( v23 )
    ExFreePoolWithTag(v23, 0x46447452u);
  return v13;
}

Referenced by: