PopSafeCopyUnicodeString
INT64 __stdcall PopSafeCopyUnicodeString(
UNICODE_STRING *SourceString,
WCHAR **BufferStart,
UINT8 *BufferEnd,
INT8 PreviousMode){
char *v4;
__int64 Length;
unsigned __int64 v8;
unsigned __int64 v9;
wchar_t *Buffer;
unsigned __int64 v11;
__int64 v12;
v4 = (char *)*BufferStart;
Length = SourceString->Length;
v8 = BufferEnd - (UINT8 *)*BufferStart;
v9 = Length + 2;
if( Length + 2 > v8 )
return 3221225485i64;
if( PreviousMode && (_WORD)Length )
{
Buffer = SourceString->Buffer;
if( ((unsigned __int8)Buffer & 1) != 0 )
ExRaiseDatatypeMisalignment();
v11 = (unsigned __int64)Buffer + Length;
if( v11 > 0x7FFFFFFF0000i64 || v11 < (unsigned __int64)Buffer )
MEMORY[0x7FFFFFFF0000] = 0;
}
if( (int)RtlStringCbCopyUnicodeString(v4, v9, SourceString) < 0 )
return 3221225485i64;
v12 = -1i64;
do
++v12;
while( *(_WORD *)&v4[2 * v12] );
if( SourceString->Length != 2 * v12 )
return 3221225485i64;
*BufferStart += v12 + 1;
return 0i64;
}Referenced by:
PopCaptureReasonContext