KiVerifyContextXStateCetUEnabled
INT64 __fastcall KiVerifyContextXStateCetUEnabled(_QWORD *a1, VOID *a2){
bool v2;
unsigned __int64 v4;
__int128 MemoryInformation;
__int128 v7;
__int128 v8;
v2 = *a1 == 1i64;
MemoryInformation = 0i64;
v7 = 0i64;
v8 = 0i64;
if( !v2 )
return 3221227018i64;
v4 = a1[1];
if( (v4 & 7) != 0 )
return 3221227018i64;
if( v4 < (unsigned __int64)a2 )
return 3221227018i64;
ZwQueryVirtualMemory((PVOID)0xFFFFFFFFFFFFFFFFi64, a2, MemoryBasicVlmInformation, &MemoryInformation, 0x30ui64, 0i64);
if( a1[1] > (unsigned __int64)(MemoryInformation + v7 - 4096) )
return 3221227018i64;
else
return 0i64;
}Referenced by:
KeVerifyContextXStateCetU
KiContinuePreviousModeUser
KiUnwindUserSspForApcContextCopyBypass