RtlpCopyXStateChunk
NTSTATUS __stdcall RtlpCopyXStateChunk(
INT8 Operation,
_CONTEXT_EX *Destination,
_CONTEXT_EX *DestinationLayout,
_CONTEXT_EX *Source,
_CONTEXT_EX *SourceLayout){
unsigned int v6;
unsigned int v7;
unsigned int v8;
unsigned __int64 *v9;
_QWORD *v10;
unsigned int v11;
_QWORD *v12;
unsigned __int64 v13;
char v14;
unsigned __int64 v15;
unsigned __int64 AlignedFeatures;
_DWORD *v17;
_DWORD *v18;
__int64 v20;
int v21;
_QWORD *v22;
unsigned __int64 v23;
unsigned __int64 *v24;
unsigned int Length;
char SourceLayouta;
Length = DestinationLayout->XState.Length;
v6 = 64;
v7 = 64;
if( Length < 0x40 )
return -2147483643;
v8 = SourceLayout->XState.Length;
if( v8 < 0x40 )
return -2147483643;
v9 = (unsigned __int64 *)((char *)Destination + DestinationLayout->XState.Offset);
v10 = (_QWORD *)((char *)&Source->All + SourceLayout->XState.Offset);
v24 = v9;
v22 = v10;
memset(v9, 0i64, 0x40u);
v11 = 2;
v12 = v10;
v13 = *v10 & (KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures | KUSER_SHARED_DATA.XState.EnabledFeatures) & 0xFFFFFFFFFFFFFFFCui64;
*v9 = v13;
if( (KUSER_SHARED_DATA.XState._bf_0 & 2) != 0 )
{
v14 = 1;
v15 = v10[1] & (KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures | KUSER_SHARED_DATA.XState.EnabledFeatures | 3) | 0x8000000000000000ui64;
AlignedFeatures = KUSER_SHARED_DATA.XState.AlignedFeatures;
}
else
{
v14 = 0;
v15 = 0i64;
AlignedFeatures = 0i64;
}
v23 = AlignedFeatures;
SourceLayouta = v14;
v9[1] = v15;
if( Operation == 1 )
{
v17 = (_DWORD *)(&KUSER_SHARED_DATA + 1028);
v18 = (_DWORD *)(&KUSER_SHARED_DATA + 1548);
while( v13 )
{
v20 = 1i64 << v11;
if( v14 )
{
if( (v20 & v15) != 0 )
{
v7 = v6;
if( (v20 & AlignedFeatures) != 0 )
v7 = (v6 + 63) & 0xFFFFFFC0;
v6 = v7 + *v18;
}
}
else
{
v21 = *(v17 - 1);
v6 = v21 + *v17 - 512;
v7 = v21 - 512;
}
if( (v20 & v13) != 0 )
{
if( v6 > Length || v6 > v8 )
return -2147483643;
memmove((char *)v24 + v7, (char *)v12 + v7, v6 - v7);
v14 = SourceLayouta;
_bittestandreset64((__int64 *)&v13, v11);
}
AlignedFeatures = v23;
++v11;
v12 = v22;
++v18;
v17 += 2;
if( v11 >= 0x40 )
return 0;
}
}
return 0;
}Referenced by:
RtlCopyContext
RtlpCopyExtendedContext