RtlLocateExtendedFeature2

CHAR *__fastcall RtlLocateExtendedFeature2(_DWORD *a1, UINT64 a2, INT64 a3, _DWORD *a4){
  __int64 v4; 
  __int64 v6; 
  int v8; 
  __int64 v9; 
  char *v10; 
  unsigned int v11; 
  int v12; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  _DWORD *v16; 
  v4 = (unsigned int)a2;
  if( (unsigned int)(a2 - 2) > 0x3D )
    return 0i64;
  v6 = 1i64 << a2;
  if( ((*(_QWORD *)a3 | *(_QWORD *)(a3 + 816)) & (1i64 << a2)) == 0 )
    return 0i64;
  v8 = *(_DWORD *)(a3 + 20);
  if( (v8 & 0xFFFFFFFC) != 0 )
    return 0i64;
  v9 = (int)a1[4];
  if( *a1 > (int)v9 || a1[1] + *a1 < (int)v9 + a1[5] )
    v10 = 0i64;
  else
    v10 = (char *)a1 + v9;
  if( !v10 )
    return 0i64;
  v11 = 2;
  if( a4 )
  {
    if( (v8 & 2) != 0 )
      v12 = *(_DWORD *)(a3 + 4 * v4 + 556);
    else
      v12 = *(_DWORD *)(a3 + 8 * v4 + 28);
    *a4 = v12;
  }
  if( (*(_DWORD *)(a3 + 20) & 2) != 0 )
  {
    v13 = *((_QWORD *)v10 + 1);
    if( (v6 & v13) != 0 )
    {
      v14 = *(_QWORD *)(a3 + 544);
      v15 = 576i64;
      if( (unsigned int)v4 > 2 )
      {
        v16 = (_DWORD *)(a3 + 564);
        do
        {
          if( ((1i64 << v11) & v13) != 0 )
          {
            if( ((1i64 << v11) & v14) != 0 )
              LODWORD(v15) = (v15 + 63) & 0xFFFFFFC0;
            v15 = (unsigned int)(*v16 + v15);
          }
          ++v11;
          ++v16;
        }
        while( v11 < (unsigned int)v4 );
      }
      if( (v6 & v14) != 0 )
        v15 = ((_DWORD)v15 + 63) & 0xFFFFFFC0;
      return &v10[v15 - 512];
    }
    return 0i64;
  }
  v15 = *(unsigned int *)(a3 + 8 * v4 + 24);
  return &v10[v15 - 512];
}

Referenced by:

KeVerifyContextXStateCetU
KiContinuePreviousModeUser
KiInitializeContextThread
KiUnwindUserSspForApcContextCopyBypass
RtlLocateExtendedFeature
RtlpPopUserShadowStack
RtlpUnwindPrologue
RtlpWalkFrameChain