KiTpDecodeModRmOperand
INT64 __fastcall KiTpDecodeModRmOperand(INT64 a1, INT64 a2, UINT64 a3, CHAR a4, CHAR a5){
__int64 v5;
INT64 v6;
unsigned __int8 v7;
INT64 RegisterAddressByIndex;
_BYTE *v11;
unsigned int v12;
_QWORD *v13;
unsigned __int64 v14;
INT64 result;
v5 = 0i64;
v6 = a1;
v7 = *(_BYTE *)(a1 + 26);
*(_BYTE *)a4 = *(_BYTE *)(a2 + 16);
*(_BYTE *)a5 = 0;
RegisterAddressByIndex = 0i64;
if( (v7 & 0xC0) == 0xC0 )
{
RegisterAddressByIndex = KiTpGetRegisterAddressByIndex(v6, a2, v7 & 7, *(_BYTE *)(v6 + 25) & 1, 1);
*v11 = 0;
*(_BYTE *)a5 = 1;
}
else if( (v7 & 7) == 4 )
{
v12 = *(unsigned __int8 *)(v6 + 27);
if( (*(_BYTE *)(v6 + 27) & 7) != 5 || v7 >= 0x40u )
RegisterAddressByIndex = *(_QWORD *)KiTpGetRegisterAddressByIndex(v6, a2, v12 & 7, *(_BYTE *)(v6 + 25) & 1, 0);
if( (v12 & 0x38) != 32 || (*(_BYTE *)(v6 + 25) & 2) != 0 )
{
v13 = (_QWORD *)KiTpGetRegisterAddressByIndex(v6, a2, (v12 >> 3) & 7, (*(_BYTE *)(v6 + 25) & 2) != 0, 0);
v5 = *v13 << (v14 >> 6);
}
}
else if( v7 >= 0x40u || (v7 & 7) != 5 || (*(_BYTE *)(v6 + 25) & 1) != 0 )
{
RegisterAddressByIndex = *(_QWORD *)KiTpGetRegisterAddressByIndex(v6, a2, v7 & 7, *(_BYTE *)(v6 + 25) & 1, 0);
}
else
{
RegisterAddressByIndex = *(_QWORD *)(*(_QWORD *)(a2 + 8) + 248i64) + *(unsigned __int8 *)(v6 + 24);
}
result = RegisterAddressByIndex + v5 + *(int *)(v6 + 28);
*(_QWORD *)a3 = result;
return result;
}Referenced by:
KiTpEmulateGroup0Instruction
KiTpEmulateGroup11Instruction
KiTpEmulateGroup1Instruction
KiTpEmulateInstruction
KiTpEmulateMovzx