RtlLocateExtendedFeature2
CHAR *__fastcall RtlLocateExtendedFeature2(_DWORD *a1, UINT64 a2, INT64 a3, _DWORD *a4){
__int64 v4;
__int64 v6;
int v8;
__int64 v9;
char *v10;
unsigned int v11;
int v12;
__int64 v13;
__int64 v14;
__int64 v15;
_DWORD *v16;
v4 = (unsigned int)a2;
if( (unsigned int)(a2 - 2) > 0x3D )
return 0i64;
v6 = 1i64 << a2;
if( ((*(_QWORD *)a3 | *(_QWORD *)(a3 + 816)) & (1i64 << a2)) == 0 )
return 0i64;
v8 = *(_DWORD *)(a3 + 20);
if( (v8 & 0xFFFFFFFC) != 0 )
return 0i64;
v9 = (int)a1[4];
if( *a1 > (int)v9 || a1[1] + *a1 < (int)v9 + a1[5] )
v10 = 0i64;
else
v10 = (char *)a1 + v9;
if( !v10 )
return 0i64;
v11 = 2;
if( a4 )
{
if( (v8 & 2) != 0 )
v12 = *(_DWORD *)(a3 + 4 * v4 + 556);
else
v12 = *(_DWORD *)(a3 + 8 * v4 + 28);
*a4 = v12;
}
if( (*(_DWORD *)(a3 + 20) & 2) != 0 )
{
v13 = *((_QWORD *)v10 + 1);
if( (v6 & v13) != 0 )
{
v14 = *(_QWORD *)(a3 + 544);
v15 = 576i64;
if( (unsigned int)v4 > 2 )
{
v16 = (_DWORD *)(a3 + 564);
do
{
if( ((1i64 << v11) & v13) != 0 )
{
if( ((1i64 << v11) & v14) != 0 )
LODWORD(v15) = (v15 + 63) & 0xFFFFFFC0;
v15 = (unsigned int)(*v16 + v15);
}
++v11;
++v16;
}
while( v11 < (unsigned int)v4 );
}
if( (v6 & v14) != 0 )
v15 = ((_DWORD)v15 + 63) & 0xFFFFFFC0;
return &v10[v15 - 512];
}
return 0i64;
}
v15 = *(unsigned int *)(a3 + 8 * v4 + 24);
return &v10[v15 - 512];
}Referenced by:
KeVerifyContextXStateCetU
KiContinuePreviousModeUser
KiInitializeContextThread
KiUnwindUserSspForApcContextCopyBypass
RtlLocateExtendedFeature
RtlpPopUserShadowStack
RtlpUnwindPrologue
RtlpWalkFrameChain