KiTpDecodeModRmOperand
NTSTATUS __stdcall KiTpDecodeModRmOperand(INT64 a1, INT64 a2, UINT64 a3, CHAR a4, CHAR a5){
__int64 v5;
INT64 v6;
unsigned __int8 v7;
__int64 v10;
__int64 v11;
_BYTE *v12;
unsigned int v13;
__int64 *v14;
_QWORD *v15;
unsigned __int64 v16;
__int64 *v17;
__int64 v18;
v5 = 0i64;
v6 = a1;
v7 = *(_BYTE *)(a1 + 26);
*(_BYTE *)a4 = *(_BYTE *)(a2 + 16);
*(_BYTE *)a5 = 0;
v10 = 0i64;
if( (v7 & 0xC0) == 0xC0 )
{
LODWORD(v11) = KiTpGetRegisterAddressByIndex(v6, a2, v7 & 7, *(_BYTE *)(v6 + 25) & 1, 1);
v10 = v11;
*v12 = 0;
*(_BYTE *)a5 = 1;
}
else if( (v7 & 7) == 4 )
{
v13 = *(unsigned __int8 *)(v6 + 27);
if( (*(_BYTE *)(v6 + 27) & 7) != 5 || v7 >= 0x40u )
{
LODWORD(v14) = KiTpGetRegisterAddressByIndex(v6, a2, v13 & 7, *(_BYTE *)(v6 + 25) & 1, 0);
v10 = *v14;
}
if( (v13 & 0x38) != 32 || (*(_BYTE *)(v6 + 25) & 2) != 0 )
{
LODWORD(v15) = KiTpGetRegisterAddressByIndex(v6, a2, (v13 >> 3) & 7, (*(_BYTE *)(v6 + 25) & 2) != 0, 0);
v5 = *v15 << (v16 >> 6);
}
}
else if( v7 >= 0x40u || (v7 & 7) != 5 || (*(_BYTE *)(v6 + 25) & 1) != 0 )
{
LODWORD(v17) = KiTpGetRegisterAddressByIndex(v6, a2, v7 & 7, *(_BYTE *)(v6 + 25) & 1, 0);
v10 = *v17;
}
else
{
v10 = *(_QWORD *)(*(_QWORD *)(a2 + 8) + 248i64) + *(unsigned __int8 *)(v6 + 24);
}
v18 = v10 + v5 + *(int *)(v6 + 28);
*(_QWORD *)a3 = v18;
return v18;
}Referenced by:
KiTpEmulateGroup0Instruction
KiTpEmulateGroup11Instruction
KiTpEmulateGroup1Instruction
KiTpEmulateInstruction
KiTpEmulateMovzx