RtlpCopyExtendedContext
INT64 __fastcall RtlpCopyExtendedContext(CHAR a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5, INT64 a6){
unsigned int v6;
char v9;
INT64 v10;
INT64 v11;
__int64 v12;
__int64 v13;
INT64 v14;
INT64 v15;
INT64 result;
v6 = a4;
if( (a4 & 0x27FFFF80) != 0x10000
&& (a4 & 0x27FFFFA0) != 0x100000
&& (a4 & 0x7FFFFF0) != 0x200000
&& (a4 & 0x7FFFFE0) != 0x400000 )
{
return 3221225485i64;
}
v9 = 1;
if( (a4 & 0x100040) == 1048640 || (a4 & 0x10040) == 65600 )
{
if( !KUSER_SHARED_DATA.XState.EnabledFeatures )
return 3221225659i64;
v9 = 3;
}
v10 = a5;
v11 = a2;
if( a3 )
v11 = a3;
if( a6 )
v10 = a6;
v12 = *(int *)(v11 + 8);
v13 = *(int *)(v10 + 8);
if( (_DWORD)v12 != (_DWORD)v13 || *(_DWORD *)(v11 + 12) < *(_DWORD *)(v10 + 12) )
return 3221225485i64;
v14 = a2 + v12;
v15 = v13 + a5;
if( (v6 & 0x10000) != 0 )
{
RtlpCopyLegacyContextX86(a1, v14, v6, v15);
}
else if( (v6 & 0x100000) != 0 )
{
RtlpCopyLegacyContextAmd64(a1, v14, v6, v15);
}
else if( (v6 & 0x200000) != 0 )
{
RtlpCopyLegacyContextArm(a1, v14, v6, v15);
}
else if( (v6 & 0x400000) != 0 )
{
RtlpCopyLegacyContextArm64(a1, v14, v6, v15);
}
if( (v9 & 2) == 0 )
return 0i64;
result = RtlpCopyXStateChunk(a1, a2, v11, a5, v10);
if( (int)result >= 0 )
return 0i64;
return result;
}Referenced by:
KiDispatchException
RtlpReadExtendedContext
RtlpWriteExtendedContext