RtlGetExtendedContextLength2
NTSTATUS __fastcall RtlGetExtendedContextLength2(UINT64 ContextFlags, _DWORD *a2, INT64 a3){
unsigned int v5;
NTSTATUS result;
int v7;
int v8;
UINT64 ContextAlign[3];
UINT64 ContextLength;
ContextAlign[0] = 0i64;
LODWORD(ContextLength) = 0;
v5 = ContextFlags;
result = RtlpValidateContextFlags(ContextFlags, (UINT64 *)((char *)ContextAlign + 4));
if( result >= 0 )
{
RtlpGetLegacyContextLength(v5, &ContextLength, ContextAlign);
v7 = ContextAlign[0];
v8 = ContextLength + 24;
if( (ContextAlign[0] & 0x200000000i64) != 0 )
{
if( (KUSER_SHARED_DATA.XState._bf_0 & 2) != 0 )
a3 &= KUSER_SHARED_DATA.XState.EnabledFeatures | KUSER_SHARED_DATA.XState.EnabledUserVisibleSupervisorFeatures | 0x8000000000000000ui64;
v8 = (~(v7 - 1) & (v8 + v7 - 1)) - v7 - 448 + RtlpGetEntireXStateAreaLength(a3);
}
*a2 = v7 + v8 - 1;
return 0;
}
return result;
}Referenced by:
KiDispatchException
NtCreateThreadEx
NtCreateUserProcess
RtlDispatchException
RtlGetExtendedContextLength
RtlRaiseException
RtlUnwind
RtlUnwindEx