RtlRestoreContext

VOID __stdcall RtlRestoreContext(PCONTEXT ContextRecord, _EXCEPTION_RECORD *ExceptionRecord){
  INT64 v2; 
  unsigned __int64 v3; 
  __int64 v5[154]; 
  _QWORD v6[6]; 
  void *Rip; 
  unsigned __int16 SegCs; 
  unsigned int EFlags; 
  void *Rsp; 
  __int64 vars20; 
  INT64 v12; 
  INT64 v13; 
  INT16 v14; 
  INT64 v15; 
  INT64 v16; 
  INT64 v17; 
  INT64 v18; 
  INT64 v19; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  INT64 v23; 
  INT64 v24; 
  INT64 v25; 
  VOID *v26; 

  if( ExceptionRecord )
  {
    if( ExceptionRecord->ExceptionCode == -2147483607 && ExceptionRecord->NumberParameters )
    {
      qmemcpy(v5, ContextRecord, sizeof(v5));
      v6[3] = v5[19];
      v6[0] = v5[31];
      RcFrameConsolidation(
        (INT64)ExceptionRecord,
        (INT64)RcFrameConsolidation,
        (INT64)v6,
        v2,
        v12,
        v13,
        v14,
        v15,
        v16,
        v17,
        v18,
        v19,
        v20,
        v21,
        v22,
        v23,
        v24,
        v25,
        v26);
      return;
    }
    if( ExceptionRecord->ExceptionCode == -2147483610 )
    {
      v3 = ExceptionRecord->ExceptionInformation[0];
      ContextRecord->_Rbx = *(_QWORD *)(v3 + 8);
      ContextRecord->_Rsp = *(_QWORD *)(v3 + 16);
      ContextRecord->_Rbp = *(_QWORD *)(v3 + 24);
      ContextRecord->_Rsi = *(_QWORD *)(v3 + 32);
      ContextRecord->_Rdi = *(_QWORD *)(v3 + 40);
      ContextRecord->_R12 = *(_QWORD *)(v3 + 48);
      ContextRecord->_R13 = *(_QWORD *)(v3 + 56);
      ContextRecord->_R14 = *(_QWORD *)(v3 + 64);
      ContextRecord->_R15 = *(_QWORD *)(v3 + 72);
      ContextRecord->_Rip = *(_QWORD *)(v3 + 80);
      ContextRecord->_MxCsr = *(_DWORD *)(v3 + 88);
      ContextRecord->_Xmm6 = *(_M128A *)(v3 + 96);
      ContextRecord->_Xmm7 = *(_M128A *)(v3 + 112);
      ContextRecord->_Xmm8 = *(_M128A *)(v3 + 128);
      ContextRecord->_Xmm9 = *(_M128A *)(v3 + 144);
      ContextRecord->_Xmm10 = *(_M128A *)(v3 + 160);
      ContextRecord->_Xmm11 = *(_M128A *)(v3 + 176);
      ContextRecord->_Xmm12 = *(_M128A *)(v3 + 192);
      ContextRecord->_Xmm13 = *(_M128A *)(v3 + 208);
      ContextRecord->_Xmm14 = *(_M128A *)(v3 + 224);
      ContextRecord->_Xmm15 = *(_M128A *)(v3 + 240);
    }
  }
  if( (ContextRecord->ContextFlags & 0xFFFFFFBF) == 1048591 )
  {
    _mm_setcsr(ContextRecord->_MxCsr);
    KeCheckStackAndTargetAddress((PVOID)ContextRecord->_Rip);
    LOWORD(vars20) = ContextRecord->SegSs;
    Rsp = (void *)ContextRecord->_Rsp;
    EFlags = ContextRecord->EFlags;
    SegCs = ContextRecord->SegCs;
    Rip = (void *)ContextRecord->_Rip;
    _disable();
    __iretq(Rip, SegCs, EFlags, Rsp, vars20);
  }
  ZwContinue(ContextRecord, 0);
}

Referenced by: