RtlLocateSupervisorFeature
PVOID __stdcall RtlLocateSupervisorFeature(PXSAVE_AREA_HEADER XStateHeader, UINT32 FeatureId){
_DWORD *v2;
__int64 v3;
_DWORD *v4;
unsigned int v6;
signed __int64 CompactionMask;
unsigned __int64 v8;
unsigned int v9;
_DWORD *v10;
v3 = FeatureId;
v4 = v2;
if( FeatureId - 2 > 0x3D )
return 0i64;
if( (KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures & (1i64 << FeatureId)) == 0 )
return 0i64;
v6 = 2;
if( (KUSER_SHARED_DATA.XState._bf_0 & 2) == 0 )
return 0i64;
CompactionMask = XStateHeader->CompactionMask;
if( CompactionMask >= 0 )
return 0i64;
v8 = CompactionMask & XStateHeader->Mask;
if( !_bittest64((const __int64 *)&v8, FeatureId) )
return 0i64;
v9 = 64;
if( (unsigned int)v3 > 2 )
{
v10 = (_DWORD *)(&KUSER_SHARED_DATA + 1548);
do
{
if( ((1i64 << v6) & CompactionMask) != 0 )
{
if( ((1i64 << v6) & KUSER_SHARED_DATA.XState.AlignedFeatures) != 0 )
v9 = (v9 + 63) & 0xFFFFFFC0;
v9 += *v10;
}
++v6;
++v10;
}
while( v6 < (unsigned int)v3 );
}
if( (KUSER_SHARED_DATA.XState.AlignedFeatures & (1i64 << v3)) != 0 )
v9 = (v9 + 63) & 0xFFFFFFC0;
if( v4 )
*v4 = *(_DWORD *)(4 * v3 - 0x87FFFFFF9FCi64);
return(char *)XStateHeader + v9;
}Referenced by:
KiGetSavedIptState
KiInitializeContextThread