PopSafeCopyUnicodeString

INT64 __stdcall PopSafeCopyUnicodeString(
        UNICODE_STRING *SourceString,
        WCHAR **BufferStart,
        UINT8 *BufferEnd,
        INT8 PreviousMode){
  char *v4; 
  __int64 Length; 
  unsigned __int64 v8; 
  unsigned __int64 v9; 
  wchar_t *Buffer; 
  unsigned __int64 v11; 
  __int64 v12; 
  v4 = (char *)*BufferStart;
  Length = SourceString->Length;
  v8 = BufferEnd - (UINT8 *)*BufferStart;
  v9 = Length + 2;
  if( Length + 2 > v8 )
    return 3221225485i64;
  if( PreviousMode && (_WORD)Length )
  {
    Buffer = SourceString->Buffer;
    if( ((unsigned __int8)Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v11 = (unsigned __int64)Buffer + Length;
    if( v11 > 0x7FFFFFFF0000i64 || v11 < (unsigned __int64)Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  if( (int)RtlStringCbCopyUnicodeString(v4, v9, SourceString) < 0 )
    return 3221225485i64;
  v12 = -1i64;
  do
    ++v12;
  while( *(_WORD *)&v4[2 * v12] );
  if( SourceString->Length != 2 * v12 )
    return 3221225485i64;
  *BufferStart += v12 + 1;
  return 0i64;
}

Referenced by:

PopCaptureReasonContext