PopCaptureReasonContext

INT64 __fastcall PopCaptureReasonContext(
        _COUNTED_REASON_CONTEXT *Context,
        INT64 PreviousMode,
        UINT8 *ImportantTimer,
        _DIAGNOSTIC_CONTEXT **ReturnContext,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  char v9; 
  UINT64 v11; 
  ULONG StringCount; 
  PUNICODE_STRING ReasonStrings; 
  signed int Flags; 
  unsigned __int64 v15; 
  ULONG v16; 
  _DIAGNOSTIC_CONTEXT *PoolWithQuotaTag; 
  _DIAGNOSTIC_CONTEXT *v18; 
  unsigned __int64 v19; 
  union _COUNTED_REASON_CONTEXT::$3195086162F21FBC862C66B8DD0AB9D0 *p_ResourceFileName; 
  UINT8 *v21; 
  INT8 v22; 
  int v23; 
  char *v24; 
  int v25; 
  unsigned __int16 *p_Length; 
  __int64 v28; 
  unsigned __int64 v29; 
  unsigned __int64 v30; 
  __int64 v31; 
  UINT8 *BufferEnd; 
  __int128 v33; 
  __int128 v34; 
  WCHAR *BufferStart; 
  INT8 PreviousModea; 
  UINT8 *v37; 
  _DIAGNOSTIC_CONTEXT **v38; 
  v38 = ReturnContext;
  v37 = ImportantTimer;
  PreviousModea = PreviousMode;
  BufferStart = 0i64;
  v9 = PreviousMode;
  v34 = 0i64;
  *ReturnContext = 0i64;
  v11 = 32i64;
  if( ImportantTimer )
    *ImportantTimer = 0;
  StringCount = 0;
  ReasonStrings = 0i64;
  if( Context )
  {
    if( Context->Version )
      return 3221225485i64;
    Flags = Context->Flags;
    if( (Flags & 1) != 0 )
    {
      if( (((unsigned __int8)Context->ResourceFileName.Length + 2) & 1) != 0 )
        return 3221225485i64;
      v11 = Context->ResourceFileName.Length + 66i64;
    }
    else
    {
      if( (Flags & 2) != 0 )
      {
        if( ((LOBYTE(Context->ResourceFileName.Length) + 2) & 1) == 0 )
        {
          StringCount = Context->StringCount;
          v11 = Context->ResourceFileName.Length + 66i64;
          v15 = 16i64 * StringCount;
          if( v15 <= 0xFFFFFFFF )
          {
            ReasonStrings = Context->ReasonStrings;
            if( (_BYTE)PreviousMode && (_DWORD)v15 )
            {
              if( ((unsigned __int8)ReasonStrings & 3) != 0 )
                ExRaiseDatatypeMisalignment();
              v30 = (unsigned __int64)ReasonStrings + (unsigned int)v15;
              if( v30 > 0x7FFFFFFF0000i64 || v30 < (unsigned __int64)ReasonStrings )
                MEMORY[0x7FFFFFFF0000] = 0;
            }
            v16 = 0;
            if( !StringCount )
              goto LABEL_12;
            p_Length = &ReasonStrings->Length;
            while( 1 )
            {
              v28 = *p_Length;
              if( v28 + v11 + 2 < v11 )
                break;
              ++v16;
              p_Length += 8;
              v11 += v28 + 2;
              if( v16 >= StringCount )
                goto LABEL_12;
            }
          }
        }
        return 3221225485i64;
      }
      if( Flags >= 0 )
        return 3221225485i64;
    }
  }
  else
  {
    Flags = 0x80000000;
  }
LABEL_12:
  if( v9 )
    PoolWithQuotaTag = (_DIAGNOSTIC_CONTEXT *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v11, 0x78435250ui64);
  else
    PoolWithQuotaTag = (_DIAGNOSTIC_CONTEXT *)ExAllocatePoolWithTag(PagedPool, v11, 0x78435250ui64);
  v18 = PoolWithQuotaTag;
  if( PoolWithQuotaTag )
  {
    *ReturnContext = PoolWithQuotaTag;
    if( Flags < 0 )
    {
      PoolWithQuotaTag->ReasonSize = 0i64;
      return 0;
    }
    v19 = ((unsigned __int64)&PoolWithQuotaTag[1].CallerType + 7) & 0xFFFFFFFFFFFFFFF8ui64;
    p_ResourceFileName = (union _COUNTED_REASON_CONTEXT::$3195086162F21FBC862C66B8DD0AB9D0 *)&Context->ResourceFileName;
    PoolWithQuotaTag->ReasonSize = (unsigned __int64)PoolWithQuotaTag + v11 - v19;
    *(_DWORD *)v19 = Flags;
    BufferStart = (WCHAR *)(v19 + 32);
    BufferEnd = (UINT8 *)PoolWithQuotaTag + v11;
    v21 = (UINT8 *)PoolWithQuotaTag + v11;
    *(_QWORD *)(v19 + 8) = 32i64;
    if( (Flags & 1) != 0 )
    {
      v23 = PopSafeCopyUnicodeString(&p_ResourceFileName->ResourceFileName, &BufferStart, v21, PreviousModea);
      if( v23 >= 0 )
      {
LABEL_19:
        if( v37 )
          *v37 = (Context->Flags & 4) != 0;
        return 0;
      }
    }
    else
    {
      v22 = PreviousModea;
      v23 = PopSafeCopyUnicodeString(&p_ResourceFileName->ResourceFileName, &BufferStart, v21, PreviousModea);
      if( v23 >= 0 )
      {
        *(_WORD *)(v19 + 16) = Context->ResourceReasonId;
        v24 = (char *)BufferStart - v19;
        *(_DWORD *)(v19 + 20) = StringCount;
        *(_QWORD *)(v19 + 24) = v24;
        v25 = 0;
        if( !StringCount )
          goto LABEL_19;
        while( 1 )
        {
          v29 = (unsigned __int64)&ReasonStrings[v25];
          if( v22 )
          {
            DWORD1(v33) = 0;
            if( v29 >= 0x7FFFFFFF0000i64 )
              v29 = 0x7FFFFFFF0000i64;
            LODWORD(v33) = *(_DWORD *)v29;
            v31 = *(_QWORD *)(v29 + 8);
            v29 = (unsigned __int64)&v34;
            *((_QWORD *)&v33 + 1) = v31;
            v34 = v33;
          }
          v23 = PopSafeCopyUnicodeString((UNICODE_STRING *)v29, &BufferStart, BufferEnd, v22);
          if( v23 < 0 )
            break;
          if( ++v25 >= StringCount )
            goto LABEL_19;
        }
      }
    }
    ExFreePoolWithTag(v18, 0x78435250u);
    *v38 = 0i64;
    return(unsigned int)v23;
  }
  return 3221225626i64;
}

Referenced by: