RtlCreateInvertedFunctionTableCacheEntry
NTSTATUS __stdcall RtlCreateInvertedFunctionTableCacheEntry(PVOID ControlPc, INT64 a2){
void *ImageBase;
int v4;
unsigned int SizeOfTable;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v6;
NTSTATUS result;
_INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo;
ImageBase = 0i64;
v4 = a2;
SizeOfTable = 0;
memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
if( (unsigned __int64)ControlPc < *(&byte_140E00020 + 1)
|| (unsigned __int64)ControlPc >= *(&byte_140E00020 + 1) + *((unsigned int *)&byte_140E00020 + 4) )
{
v6 = RtlpxLookupFunctionTable(ControlPc, &FunctionTableInfo);
}
else
{
v6 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)byte_140E00020;
FunctionTableInfo = *(_INVERTED_FUNCTION_TABLE_ENTRY *)&byte_140E00020;
}
if( v6 )
{
ImageBase = FunctionTableInfo.ImageBase;
SizeOfTable = FunctionTableInfo.SizeOfTable;
}
byte_140E00020 = (ULONG_PTR)v6;
*((_DWORD *)&byte_140E00020 + 5) = SizeOfTable;
*(&byte_140E00020 + 1) = (ULONG_PTR)ImageBase;
*((_DWORD *)&byte_140E00020 + 4) = v4;
RtlRemoveInvertedFunctionTable(ControlPc);
return result;
}Referenced by:
MiInitializeLoadedModuleList