PopSafeCopyUnicodeString
NTSTATUS __stdcall PopSafeCopyUnicodeString(
_UNICODE_STRING *SourceString,
WCHAR **BufferStart,
UINT8 *BufferEnd,
WCHAR *PreviousMode,
UINT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
CHAR *v8;
__int64 Length;
unsigned __int64 v12;
UINT64 v13;
wchar_t *Buffer;
unsigned __int64 v15;
__int64 v16;
v8 = (CHAR *)*BufferStart;
Length = SourceString->Length;
v12 = BufferEnd - (UINT8 *)*BufferStart;
v13 = Length + 2;
if( Length + 2 > v12 )
return -1073741811;
if( (_BYTE)PreviousMode && (_WORD)Length )
{
Buffer = SourceString->Buffer;
if( ((unsigned __int8)Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
v15 = (unsigned __int64)Buffer + Length;
if( v15 > 0x7FFFFFFF0000i64 || v15 < (unsigned __int64)Buffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( RtlStringCbCopyUnicodeString(v8, v13, SourceString) < 0 )
return -1073741811;
v16 = -1i64;
do
++v16;
while( *(_WORD *)&v8[2 * v16] );
if( SourceString->Length != 2 * v16 )
return -1073741811;
*BufferStart += v16 + 1;
return 0;
}Referenced by:
PopCaptureReasonContext