RtlInitializeExtendedContext2
__int64 __fastcall RtlInitializeExtendedContext2(__int64 a1, int a2, _QWORD *a3, unsigned __int64 a4){
_DWORD *v4;
unsigned __int64 v5;
char v7;
_DWORD *v8;
int v9;
__int64 result;
size_t v11;
unsigned int v12;
size_t v13;
v4 = 0i64;
v5 = a4;
if( (a2 & 0x27FFFF80) != 0x10000
&& (a2 & 0x27FFFFA0) != 0x100000
&& (a2 & 0x7FFFFF0) != 0x200000
&& (a2 & 0x7FFFFE0) != 0x400000 )
{
return 3221225485i64;
}
v7 = 1;
if( (a2 & 0x100040) == 1048640 || (a2 & 0x10040) == 65600 )
{
if( !KUSER_SHARED_DATA.XState.EnabledFeatures )
return 3221225659i64;
v7 = 3;
}
if( (a2 & 0x10000) != 0 )
{
v8 = (_DWORD *)((a1 + 3) & 0xFFFFFFFFFFFFFFFCui64);
v4 = v8 + 179;
LABEL_16:
*v8 = a2;
goto LABEL_8;
}
if( (a2 & 0x100000) == 0 )
{
if( (a2 & 0x200000) != 0 )
{
v8 = (_DWORD *)((a1 + 7) & 0xFFFFFFFFFFFFFFF8ui64);
v4 = v8 + 104;
}
else
{
if( (a2 & 0x400000) == 0 )
goto LABEL_9;
v8 = (_DWORD *)((a1 + 15) & 0xFFFFFFFFFFFFFFF0ui64);
v4 = v8 + 228;
}
goto LABEL_16;
}
v8 = (_DWORD *)((a1 + 15) & 0xFFFFFFFFFFFFFFF0ui64);
v8[12] = a2;
v4 = v8 + 308;
LABEL_8:
v4[3] = (_DWORD)v4 - (_DWORD)v8;
LABEL_9:
v9 = v4[3];
v4[2] = -v9;
*v4 = -v9;
v4[1] = v9 + 24;
if( (a2 & 0x10020) != 65568 && (a2 & 0x10000) != 0 )
v4[3] = 204;
if( (v7 & 2) != 0 )
{
if( (KUSER_SHARED_DATA.XState._bf_0 & 2) != 0 )
v5 = (KUSER_SHARED_DATA.XState.EnabledFeatures | KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures | 0x8000000000000000ui64) & a4;
v11 = RtlpGetEntireXStateAreaLength(v5) - 512;
memset((VOID *)(((unsigned __int64)v4 + 87) & 0xFFFFFFFFFFFFFFC0ui64), 0i64, v11);
if( (KUSER_SHARED_DATA.XState._bf_0 & 2) != 0 )
*(_QWORD *)((((unsigned __int64)v4 + 87) & 0xFFFFFFFFFFFFFFC0ui64) + 8) = v5 | 0x8000000000000000ui64;
v12 = (((_DWORD)v4 + 87) & 0xFFFFFFC0) - (_DWORD)v4;
v4[4] = v12;
v13 = v11 + v12 - *v4;
v4[5] = v11;
result = 0i64;
v4[1] = v13;
*a3 = v4;
}
else
{
*((_QWORD *)v4 + 2) = 25i64;
result = 0i64;
*a3 = v4;
}
return result;
}Referenced by:
KiContinuePreviousModeUser
KiDispatchException
NtCreateThreadEx
NtCreateUserProcess
RtlDispatchException
RtlInitializeExtendedContext
RtlRaiseException
RtlUnwind
RtlUnwindEx