PopCaptureReasonContext

NTSTATUS __stdcall PopCaptureReasonContext(
        _COUNTED_REASON_CONTEXT *Context,
        INT8 PreviousMode,
        UINT8 *ImportantTimer,
        _DIAGNOSTIC_CONTEXT **ReturnContext){
  UINT64 v7; 
  ULONG StringCount; 
  PUNICODE_STRING ReasonStrings; 
  signed int Flags; 
  unsigned __int64 v11; 
  ULONG v12; 
  _DIAGNOSTIC_CONTEXT *PoolWithQuotaTag; 
  WCHAR *v14; 
  _DIAGNOSTIC_CONTEXT *v15; 
  unsigned __int64 v16; 
  _COUNTED_REASON_CONTEXT::$3195086162F21FBC862C66B8DD0AB9D0 *p_ResourceFileName; 
  UINT8 *v18; 
  char v19; 
  int v20; 
  WCHAR *v21; 
  char *v22; 
  int v23; 
  unsigned __int16 *p_Length; 
  __int64 v26; 
  unsigned __int64 v27; 
  unsigned __int64 v28; 
  __int64 v29; 
  UINT8 *BufferEnd; 
  UINT8 *BufferEnda; 
  INT64 v32; 
  INT64 v33; 
  INT64 v34; 
  __int128 v35; 
  INT64 v36; 
  __int128 v37; 
  WCHAR *BufferStart; 
  WCHAR *PreviousModea; 
  UINT8 *v40; 
  _DIAGNOSTIC_CONTEXT **v41; 

  v41 = ReturnContext;
  v40 = ImportantTimer;
  LOBYTE(PreviousModea) = PreviousMode;
  BufferStart = 0i64;
  v37 = 0i64;
  *ReturnContext = 0i64;
  v7 = 32i64;
  if( ImportantTimer )
    *ImportantTimer = 0;
  StringCount = 0;
  ReasonStrings = 0i64;
  if( Context )
  {
    if( Context->Version )
      return -1073741811;
    Flags = Context->Flags;
    if( (Flags & 1) != 0 )
    {
      if( (((unsigned __int8)Context->ResourceFileName.Length + 2) & 1) != 0 )
        return -1073741811;
      v7 = Context->ResourceFileName.Length + 66i64;
    }
    else
    {
      if( (Flags & 2) != 0 )
      {
        if( ((LOBYTE(Context->ResourceFileName.Length) + 2) & 1) == 0 )
        {
          StringCount = Context->StringCount;
          v7 = Context->ResourceFileName.Length + 66i64;
          v11 = 16i64 * StringCount;
          if( v11 <= 0xFFFFFFFF )
          {
            ReasonStrings = Context->ReasonStrings;
            if( PreviousMode && (_DWORD)v11 )
            {
              if( ((unsigned __int8)ReasonStrings & 3) != 0 )
                ExRaiseDatatypeMisalignment();
              v28 = (unsigned __int64)ReasonStrings + (unsigned int)v11;
              if( v28 > 0x7FFFFFFF0000i64 || v28 < (unsigned __int64)ReasonStrings )
                MEMORY[0x7FFFFFFF0000] = 0;
            }
            v12 = 0;
            if( !StringCount )
              goto LABEL_12;
            p_Length = &ReasonStrings->Length;
            while( 1 )
            {
              v26 = *p_Length;
              if( v26 + v7 + 2 < v7 )
                break;
              ++v12;
              p_Length += 8;
              v7 += v26 + 2;
              if( v12 >= StringCount )
                goto LABEL_12;
            }
          }
        }
        return -1073741811;
      }
      if( Flags >= 0 )
        return -1073741811;
    }
  }
  else
  {
    Flags = 0x80000000;
  }
LABEL_12:
  if( PreviousMode )
    PoolWithQuotaTag = (_DIAGNOSTIC_CONTEXT *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v7, 0x78435250ui64);
  else
    PoolWithQuotaTag = (_DIAGNOSTIC_CONTEXT *)ExAllocatePoolWithTag(1ui64, v7, 2017677904i64);
  v15 = PoolWithQuotaTag;
  if( PoolWithQuotaTag )
  {
    *ReturnContext = PoolWithQuotaTag;
    if( Flags < 0 )
    {
      PoolWithQuotaTag->ReasonSize = 0i64;
      return 0;
    }
    v16 = ((unsigned __int64)&PoolWithQuotaTag[1].CallerType + 7) & 0xFFFFFFFFFFFFFFF8ui64;
    p_ResourceFileName = (_COUNTED_REASON_CONTEXT::$3195086162F21FBC862C66B8DD0AB9D0 *)&Context->ResourceFileName;
    PoolWithQuotaTag->ReasonSize = (unsigned __int64)PoolWithQuotaTag + v7 - v16;
    *(_DWORD *)v16 = Flags;
    BufferStart = (WCHAR *)(v16 + 32);
    BufferEnd = (UINT8 *)PoolWithQuotaTag + v7;
    v18 = (UINT8 *)PoolWithQuotaTag + v7;
    *(_QWORD *)(v16 + 8) = 32i64;
    if( (Flags & 1) != 0 )
    {
      LOBYTE(v14) = (_BYTE)PreviousModea;
      v20 = PopSafeCopyUnicodeString(
              &p_ResourceFileName->ResourceFileName,
              &BufferStart,
              v18,
              v14,
              (UINT64)BufferEnd,
              v32,
              v34,
              v36);
      if( v20 >= 0 )
      {
LABEL_19:
        if( v40 )
          *v40 = (Context->Flags & 4) != 0;
        return 0;
      }
    }
    else
    {
      v19 = (char)PreviousModea;
      LOBYTE(v14) = (_BYTE)PreviousModea;
      v20 = PopSafeCopyUnicodeString(
              &p_ResourceFileName->ResourceFileName,
              &BufferStart,
              v18,
              v14,
              (UINT64)BufferEnd,
              v32,
              v34,
              v36);
      if( v20 >= 0 )
      {
        *(_WORD *)(v16 + 16) = Context->ResourceReasonId;
        v22 = (char *)BufferStart - v16;
        *(_DWORD *)(v16 + 20) = StringCount;
        *(_QWORD *)(v16 + 24) = v22;
        v23 = 0;
        if( !StringCount )
          goto LABEL_19;
        while( 1 )
        {
          v27 = (unsigned __int64)&ReasonStrings[v23];
          if( v19 )
          {
            DWORD1(v35) = 0;
            if( v27 >= 0x7FFFFFFF0000i64 )
              v27 = 0x7FFFFFFF0000i64;
            LODWORD(v35) = *(_DWORD *)v27;
            v29 = *(_QWORD *)(v27 + 8);
            v27 = (unsigned __int64)&v37;
            *((_QWORD *)&v35 + 1) = v29;
            v37 = v35;
          }
          LOBYTE(v21) = v19;
          v20 = PopSafeCopyUnicodeString(
                  (_UNICODE_STRING *)v27,
                  &BufferStart,
                  BufferEnda,
                  v21,
                  (UINT64)BufferEnda,
                  v33,
                  v35,
                  *((INT64 *)&v35 + 1));
          if( v20 < 0 )
            break;
          if( ++v23 >= StringCount )
            goto LABEL_19;
        }
      }
    }
    ExFreePoolWithTag(v15, 0x78435250u);
    *v41 = 0i64;
    return v20;
  }
  return -1073741670;
}

Referenced by: