KiTpIsSupportedKernelTracepointLocation

BOOL __stdcall KiTpIsSupportedKernelTracepointLocation(UINT64 Address, ULONGLONG Maximum){
  IMAGE_NT_HEADERS *v4; 
  int *v5; 
  int v6; 
  char v7; 
  v4 = RtlImageNtHeader((PVOID)Address);
  if( !v4 )
    return 0;
  RtlSectionTableFromVirtualAddress(v4, Address);
  if( !v5 )
    return 0;
  if( (v5[9] & 0x2000020) != 32 )
    return 0;
  v6 = *v5;
  if( *v5 == 1414090313 || v6 == 1396790859 )
    return 0;
  if( v6 == 1162297680 && v5[1] )
  {
    v7 = *((_BYTE *)v5 + 4);
    if( v7 == 119 )
    {
      if( *((_BYTE *)v5 + 5) == 120 )
        return 0;
    }
    else if( v7 == 86 && *((_BYTE *)v5 + 5) == 82 && *((_BYTE *)v5 + 6) == 70 )
    {
      return 0;
    }
  }
  return(PVOID)Address != PsHalImageBase
      && (Address != PsNtosImageBase
       || v6 != 1128354388 && v6 != 1347769157 && !(unsigned int)KiTpIsExcludedKernelTracepointLocation(Maximum));
}

Referenced by: