KiUnwindUserSspForApcContextCopyBypass

NTSTATUS __stdcall KiUnwindUserSspForApcContextCopyBypass(_CONTEXT_EX *SourceLayout){
  unsigned int Offset; 
  NTSTATUS result; 
  unsigned int v4; 
  unsigned __int64 v5; 
  signed __int64 v6; 
  void *v7; 
  void *v8; 
  _CONTEXT_EX *v9; 
  CHAR v10; 
  char *ExtendedFeature2; 
  char *v12; 
  UINT64 ContextFlags; 
  _CONTEXT_EX *ContextEx; 

  Offset = SourceLayout[2].All.Offset;
  ContextEx = 0i64;
  ContextFlags = Offset;
  result = RtlpSanitizeContextFlags(&ContextFlags, 1);
  if( result >= 0 )
  {
    v4 = ContextFlags;
    if( (ContextFlags & 0x100040) != 1048640 )
      return -1073741823;
    result = RtlGetExtendedContextLength((unsigned int)ContextFlags, (UINT64 *)((char *)&ContextFlags + 4));
    if( result >= 0 )
    {
      v5 = HIDWORD(ContextFlags) + 15i64;
      if( v5 <= HIDWORD(ContextFlags) )
        v5 = 0xFFFFFFFFFFFFFF0i64;
      v6 = v5 & 0xFFFFFFFFFFFFFFF0ui64;
      v7 = alloca(v6);
      v8 = alloca(v6);
      result = RtlInitializeExtendedContext(&ContextFlags, v4, &ContextEx);
      if( result >= 0 )
      {
        LOBYTE(v9) = 1;
        result = RtlpReadExtendedContext(v10, v9, (UINT64)ContextEx, (VOID *)v4, SourceLayout);
        if( result >= 0 )
        {
          ExtendedFeature2 = RtlLocateExtendedFeature2(ContextEx, 0xBu, 0xFFFFF780000003D8ui64, 0i64);
          v12 = ExtendedFeature2;
          if( ExtendedFeature2 && (*(_DWORD *)((_BYTE *)&ContextFlags + SLODWORD(STACK[0x510]) + 1232) & 0x800i64) != 0 )
          {
            *((_QWORD *)ExtendedFeature2 + 1) -= 8i64;
            result = KiVerifyContextXStateCetUEnabled(ExtendedFeature2, (void *)__readmsr(0x6A7u));
            if( result >= 0 )
            {
              __writemsr(0x6A7u, *((_QWORD *)v12 + 1));
              return 0;
            }
            return result;
          }
          return -1073741823;
        }
      }
    }
  }
  return result;
}

Referenced by: