PspWow64GetContextThread

int __fastcall PspWow64GetContextThread(__int64 a1, int *a2, int a3, char a4){
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  int ExtendedContextLength; 
  unsigned int TransactionKey_high; 
  unsigned __int64 v13; 
  void *v14; 
  int *p_ContextFlags; 
  INT64 *v16; 
  int *QuadPart; 
  unsigned __int64 v18; 
  signed __int64 v19; 
  void *v20; 
  void *v21; 
  _LARGE_INTEGER *v22; 
  _DWORD *v23; 
  INT64 v24; 
  int *CpuAreaContextLength; 
  UINT64 *CpuAreaContextLengtha; 
  UINT64 *CpuAreaContextAlignment; 
  UINT64 CpuAreaContextAlignmenta; 
  UINT64 v29; 
  UINT16 v30; 
  _TRANSACTION_NOTIFICATION ContextFlags; 
  _ETHREAD *TargetThread; 
  UINT64 Asynchronous[2]; 
  __int64 v34; 
  INT64 result[90]; 
  TargetThread = (_ETHREAD *)a1;
  *(_QWORD *)&ContextFlags.ArgumentLength = 0i64;
  memset((INT64)result, 0i64);
  ContextFlags.TransactionNotification = 0;
  ContextFlags.TmVirtualClock.QuadPart = 0i64;
  LOBYTE(ContextFlags.TransactionKey) = 0;
  *(_OWORD *)Asynchronous = 0i64;
  v34 = 0i64;
  if( a3 != 716 )
    return -1073741820;
  v8 = *(_QWORD *)(a1 + 544);
  v9 = *(_QWORD *)(v8 + 1408);
  if( !v9 || *(_WORD *)(v9 + 8) != 332 )
    return -1073741811;
  if( a4 )
  {
    v10 = (__int64)a2;
    if( (unsigned __int64)a2 >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    HIDWORD(ContextFlags.TransactionKey) = *(_DWORD *)v10;
  }
  else
  {
    HIDWORD(ContextFlags.TransactionKey) = *a2;
  }
  ExtendedContextLength = RtlpWow64SanitizeContextFlags((UINT64 *)((char *)&ContextFlags.TransactionKey + 4), a4);
  if( ExtendedContextLength >= 0 )
  {
    TransactionKey_high = HIDWORD(ContextFlags.TransactionKey);
    if( !a4 )
    {
      p_ContextFlags = a2;
      QuadPart = a2 + 179;
LABEL_15:
      ExtendedContextLength = PspWow64ReadOrWriteThreadCpuArea(
                                (_EPROCESS *)v8,
                                TargetThread,
                                1u,
                                result,
                                (UINT64)CpuAreaContextLength,
                                (UINT64)CpuAreaContextAlignment,
                                0i64,
                                (UINT8 *)&ContextFlags,
                                v30);
      if( ExtendedContextLength >= 0 )
      {
        if( LOBYTE(ContextFlags.TransactionKey) && (TransactionKey_high & 0x10040) == 65600 )
        {
          return -1073741637;
        }
        else
        {
          ExtendedContextLength = RtlGetExtendedContextLength(
                                    0x4010001Fui64,
                                    (UINT64 *)&ContextFlags.TransactionNotification);
          if( ExtendedContextLength >= 0 )
          {
            v18 = ContextFlags.TransactionNotification + 15i64;
            if( v18 <= ContextFlags.TransactionNotification )
              v18 = 0xFFFFFFFFFFFFFF0i64;
            v19 = v18 & 0xFFFFFFFFFFFFFFF0ui64;
            v20 = alloca(v19);
            v21 = alloca(v19);
            ExtendedContextLength = RtlInitializeExtendedContext(
                                      (INT64)&ContextFlags,
                                      0x4010001Fui64,
                                      &ContextFlags.ArgumentLength);
            if( ExtendedContextLength >= 0 )
            {
              if( (TransactionKey_high & 0x10040) == 65600 )
              {
                LODWORD(Asynchronous[1]) |= 0x100040u;
                v23 = *(_DWORD **)&ContextFlags.ArgumentLength;
                *(_QWORD *)(*(_QWORD *)&ContextFlags.ArgumentLength + 16i64) = *((_QWORD *)QuadPart + 2);
                v23[4] += (_DWORD)QuadPart - (_DWORD)v23;
                v23[1] = v23[4] + v23[5] - *v23;
              }
              LODWORD(CpuAreaContextLengtha) = 1;
              LOBYTE(v22) = 1;
              ExtendedContextLength = PspGetContextThreadInternal(
                                        TargetThread,
                                        &ContextFlags,
                                        0i64,
                                        v22,
                                        CpuAreaContextLengtha,
                                        CpuAreaContextAlignmenta,
                                        v29);
              if( ExtendedContextLength >= 0 )
              {
                if( LOBYTE(ContextFlags.TransactionKey) )
                  ExtendedContextLength = RtlCopyContext(
                                            (_CONTEXT *)p_ContextFlags,
                                            (unsigned int)*p_ContextFlags,
                                            (_CONTEXT *)result);
                else
                  ExtendedContextLength = RtlpWow64GetContextOnAmd64(
                                            (INT64)result,
                                            (INT64)&ContextFlags,
                                            (INT64)p_ContextFlags);
                if( ExtendedContextLength >= 0 )
                {
                  if( a4 )
                  {
                    ExtendedContextLength = RtlpWriteExtendedContext(
                                              v24,
                                              (INT64)(a2 + 179),
                                              (INT64)Asynchronous,
                                              TransactionKey_high,
                                              (INT64)QuadPart);
                    *(&ContextFlags.TransactionNotification + 1) = ExtendedContextLength;
                  }
                }
              }
            }
          }
        }
      }
      return ExtendedContextLength;
    }
    ExtendedContextLength = RtlGetExtendedContextLength(
                              HIDWORD(ContextFlags.TransactionKey),
                              (UINT64 *)&ContextFlags.TransactionNotification);
    if( ExtendedContextLength >= 0 )
    {
      v13 = ContextFlags.TransactionNotification + 15i64;
      if( v13 <= ContextFlags.TransactionNotification )
        v13 = 0xFFFFFFFFFFFFFF0i64;
      v14 = alloca(v13 & 0xFFFFFFFFFFFFFFF0ui64);
      p_ContextFlags = (int *)&ContextFlags;
      memset((INT64)&ContextFlags, 0i64);
      ExtendedContextLength = RtlInitializeExtendedContext(
                                (INT64)&ContextFlags,
                                TransactionKey_high,
                                (LARGE_INTEGER *)&ContextFlags.TmVirtualClock.QuadPart);
      if( ExtendedContextLength >= 0 )
      {
        CpuAreaContextAlignment = Asynchronous;
        CpuAreaContextLength = a2;
        QuadPart = (int *)ContextFlags.TmVirtualClock.QuadPart;
        ExtendedContextLength = RtlpReadExtendedContext(v16, 0i64, (BYTE *)ContextFlags.TmVirtualClock.QuadPart);
        if( ExtendedContextLength >= 0 )
          goto LABEL_15;
      }
    }
  }
  return ExtendedContextLength;
}

Referenced by: