ExpCovGetSectionInfo
VOID *__fastcall ExpCovGetSectionInfo(VOID *ImageBaseAddress, UINT64 *CoverageSectionSize){
IMAGE_NT_HEADERS *v4;
IMAGE_NT_HEADERS *v5;
unsigned int NumberOfSections;
char *v7;
__int64 v8;
_DWORD *v9;
__int64 v11;
_DWORD *v12;
unsigned __int64 v13;
*(_DWORD *)CoverageSectionSize = 0;
v4 = RtlImageNtHeader(ImageBaseAddress);
v5 = v4;
if( !v4 )
return 0i64;
NumberOfSections = v4->FileHeader.NumberOfSections;
v7 = (char *)v4 + v4->FileHeader.SizeOfOptionalHeader;
v8 = 0i64;
v9 = v7 + 24;
if( !v5->FileHeader.NumberOfSections )
return 0i64;
while( *v9 != 1987011374 )
{
v8 = (unsigned int)(v8 + 1);
v9 += 10;
if( (unsigned int)v8 >= NumberOfSections )
return 0i64;
}
v11 = *(unsigned int *)&v7[40 * v8 + 32];
v12 = (char *)ImageBaseAddress + *(unsigned int *)&v7[40 * v8 + 36];
if( (char *)v12 + v11 > (char *)ImageBaseAddress + v5->OptionalHeader.SizeOfImage
|| !*(_DWORD *)&v7[40 * v8 + 40]
|| (unsigned int)v11 < 0x28
|| *v12 != -557841984
|| (v13 = (unsigned int)v12[6], (_DWORD)v13 != (_DWORD)v11)
|| v13 <= (unsigned __int64)(unsigned int)v12[7] + 40
|| (v12[8] & 7) != 0 )
{
DbgPrintEx(0x7Eu, 0, (PCSTR)&stru_1407D9AB0.P3Home, ImageBaseAddress);
return 0i64;
}
*(_DWORD *)CoverageSectionSize = v13;
return v12;
}Referenced by:
MiConstructLoaderEntry