KeCopyLastBranchInformation

UINT64 __stdcall KeCopyLastBranchInformation(INT64 a1, INT64 a2){
  UINT64 result; 
  _QWORD *v4; 
  __int64 v5; 

  if( (*(_BYTE *)(a2 + 368) & 1) != 0 )
  {
    result = *(unsigned int *)(a2 + 256);
    if( (result & 0x100) == 0 )
    {
LABEL_3:
      *(_OWORD *)(a1 + 1200) = 0i64;
      *(_OWORD *)(a1 + 1216) = 0i64;
      return result;
    }
  }
  else
  {
    result = (UINT64)KeGetCurrentPrcb();
    if( (*(_DWORD *)(result + 328) & 0x100i64) == 0 )
      goto LABEL_3;
  }
  v4 = (_QWORD *)(a1 + 1200);
  *(_OWORD *)(a1 + 1200) = *(_OWORD *)(a2 + 272);
  *(_OWORD *)(a1 + 1216) = *(_OWORD *)(a2 + 288);
  if( (*(_BYTE *)(a2 + 368) & 1) != 0 )
  {
    v5 = 4i64;
    do
    {
      result = *v4 & 0x7FFFFFFFFFFFFFFFi64;
      if( result > 0x7FFFFFFEFFFFi64 )
        *v4 = 0i64;
      ++v4;
      --v5;
    }
    while( v5 );
  }
  return result;
}

Referenced by: