MiCheckDosCalls
UINT64 __stdcall MiCheckDosCalls(IMAGE_OS2_HEADER *Os2Header, UINT64 HeaderSize){
__int64 ne_cmod;
__int64 ne_modtab;
unsigned __int16 *v5;
unsigned __int16 i;
UINT64 v7;
int v8;
ne_cmod = Os2Header->ne_cmod;
if( (_WORD)ne_cmod )
{
ne_modtab = Os2Header->ne_modtab;
v5 = (WORD *)((char *)&Os2Header->ne_magic + ne_modtab);
if( ne_modtab + 2 * ne_cmod <= HeaderSize )
{
for( i = 0; i < (unsigned __int16)ne_cmod; ++i )
{
v7 = Os2Header->ne_imptab + (unsigned int)*v5;
if( v7 >= HeaderSize )
break;
v8 = *((unsigned __int8 *)&Os2Header->ne_magic + v7);
if( !(_BYTE)v8 || (unsigned int)(v7 + v8) >= HeaderSize )
break;
if( (_BYTE)v8 == 8 && *(_QWORD *)((char *)&Os2Header->ne_magic + v7 + 1) == 0x534C4C4143534F44i64 )
return 1i64;
++v5;
}
}
}
return 0i64;
}Referenced by:
MiComputeBadImageHeaderType