KiUnwindUserSspForApcContextCopyBypass

INT64 __fastcall KiUnwindUserSspForApcContextCopyBypass(INT64 a1){
  unsigned int v1; 
  INT64 result; 
  unsigned int v3; 
  unsigned __int64 v4; 
  signed __int64 v5; 
  void *v6; 
  void *v7; 
  UINT64 *v8; 
  INT64 *v9; 
  CHAR *ExtendedFeature2; 
  CHAR *v11; 
  UINT64 ContextFlags; 
  BYTE *v13; 
  v1 = *(_DWORD *)(a1 + 48);
  v13 = 0i64;
  ContextFlags = v1;
  LODWORD(result) = RtlpSanitizeContextFlags(&ContextFlags, 1);
  if( (int)result >= 0 )
  {
    v3 = ContextFlags;
    if( (ContextFlags & 0x100040) != 1048640 )
      return 3221225473i64;
    LODWORD(result) = RtlGetExtendedContextLength((unsigned int)ContextFlags, (UINT64 *)((char *)&ContextFlags + 4));
    if( (int)result >= 0 )
    {
      v4 = HIDWORD(ContextFlags) + 15i64;
      if( v4 <= HIDWORD(ContextFlags) )
        v4 = 0xFFFFFFFFFFFFFF0i64;
      v5 = v4 & 0xFFFFFFFFFFFFFFF0ui64;
      v6 = alloca(v5);
      v7 = alloca(v5);
      LODWORD(result) = RtlInitializeExtendedContext((INT64)&ContextFlags, v3, &v13);
      if( (int)result >= 0 )
      {
        LOBYTE(v8) = 1;
        result = RtlpReadExtendedContext(v9, v8, v13);
        if( (int)result >= 0 )
        {
          ExtendedFeature2 = RtlLocateExtendedFeature2(v13, 0xBui64, 0xFFFFF780000003D8ui64, 0i64);
          v11 = ExtendedFeature2;
          if( ExtendedFeature2 && (*(_DWORD *)((_BYTE *)&ContextFlags + SLODWORD(STACK[0x510]) + 1232) & 0x800i64) != 0 )
          {
            *((_QWORD *)ExtendedFeature2 + 1) -= 8i64;
            result = KiVerifyContextXStateCetUEnabled(ExtendedFeature2, (VOID *)__readmsr(0x6A7u));
            if( (int)result >= 0 )
            {
              __writemsr(0x6A7u, *((_QWORD *)v11 + 1));
              return 0i64;
            }
            return result;
          }
          return 3221225473i64;
        }
      }
    }
  }
  return result;
}

Referenced by: