PopSafeCopyUnicodeString

NTSTATUS __stdcall PopSafeCopyUnicodeString(
        _UNICODE_STRING *SourceString,
        WCHAR **BufferStart,
        UINT8 *BufferEnd,
        WCHAR *PreviousMode,
        UINT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  CHAR *v8; 
  __int64 Length; 
  unsigned __int64 v12; 
  UINT64 v13; 
  wchar_t *Buffer; 
  unsigned __int64 v15; 
  __int64 v16; 

  v8 = (CHAR *)*BufferStart;
  Length = SourceString->Length;
  v12 = BufferEnd - (UINT8 *)*BufferStart;
  v13 = Length + 2;
  if( Length + 2 > v12 )
    return -1073741811;
  if( (_BYTE)PreviousMode && (_WORD)Length )
  {
    Buffer = SourceString->Buffer;
    if( ((unsigned __int8)Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v15 = (unsigned __int64)Buffer + Length;
    if( v15 > 0x7FFFFFFF0000i64 || v15 < (unsigned __int64)Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  if( RtlStringCbCopyUnicodeString(v8, v13, SourceString) < 0 )
    return -1073741811;
  v16 = -1i64;
  do
    ++v16;
  while( *(_WORD *)&v8[2 * v16] );
  if( SourceString->Length != 2 * v16 )
    return -1073741811;
  *BufferStart += v16 + 1;
  return 0;
}

Referenced by:

PopCaptureReasonContext