KiTpFetchImmediateOperand
__int64 __fastcall KiTpFetchImmediateOperand(__int64 a1, __int64 a2, _DWORD *a3){
unsigned int v3;
int v5;
__int64 result;
char v7;
__int64 v8;
__int64 v9;
v3 = *(unsigned __int8 *)(a1 + 23);
v9 = 0i64;
v5 = v3 >> 3;
if( a2 )
{
*a3 += v5;
return 0i64;
}
else
{
result = KiTpFetchInstructionBytes(a1, &v9, v5, a3);
if( (int)result >= 0 )
{
v7 = *(_BYTE *)(a1 + 23);
switch( v7 )
{
case 8:
v8 = (char)v9;
break;
case 16:
v8 = (__int16)v9;
break;
case 32:
v8 = (int)v9;
break;
default:
v8 = v9;
break;
}
*(_QWORD *)(a1 + 32) = v8;
}
}
return result;
}Referenced by:
KiTpEmulateGroup11Instruction
KiTpEmulateGroup1Instruction
KiTpEmulateMovRegImm