KiTpEmulateRegisterPushPop
NTSTATUS __stdcall KiTpEmulateRegisterPushPop(INT64 a1, INT64 a2, CHAR a3){
NTSTATUS result;
unsigned __int8 v6;
__int64 v7;
char v8;
if( a2 )
{
KiTpGetRegisterAddressByIndex(a1, a2, a3 & 7, *(_BYTE *)(a1 + 25) & 1, 1);
v6 = *(_BYTE *)(a1 + 1) >> 3;
v7 = *(_QWORD *)(*(_QWORD *)(a2 + 8) + 152i64) - v6;
if( (v8 & 8) != 0 )
v7 = v6 + *(_QWORD *)(*(_QWORD *)(a2 + 8) + 152i64);
KiTpAccessMemory();
if( result >= 0 )
*(_QWORD *)(*(_QWORD *)(a2 + 8) + 152i64) = v7;
}
else
{
if( *(_BYTE *)(a1 + 1) != 16 )
*(_BYTE *)(a1 + 1) = 64;
return 0;
}
return result;
}Referenced by:
KiTpEmulateInstruction