RtlUpdateImportRelocationsInImage
__int64 __fastcall RtlUpdateImportRelocationsInImage(
PVOID BaseAddress,
__int64 a2,
UINT64 a3,
unsigned int (*a4)(void),
__int64 a5,
__int64 a6,
char a7,
char a8){
_DWORD *v9;
unsigned int v12;
int v13;
int v14;
char *v15;
unsigned __int64 v16;
char *i;
_DWORD *v18;
unsigned __int64 v19;
unsigned __int64 v20;
UINT64 *v21;
INT64 a5a;
INT64 v24;
SIZE_T NumberOfBytes;
INT64 a3a;
_DWORD *PoolWithTag;
INT64 v28[2];
__int128 v29;
__int128 v30;
unsigned int v31;
v31 = a3;
LODWORD(a3a) = 0;
v9 = 0i64;
LODWORD(NumberOfBytes) = 0;
v12 = a3;
PoolWithTag = 0i64;
*(_OWORD *)v28 = 0i64;
v29 = 0i64;
v30 = 0i64;
v13 = RtlpCaptureRetpolineBinaryInfoForImage(BaseAddress, a2, a3, a5, a6, (INT64)v28);
if( v13 < 0 )
return(unsigned int)v13;
if( a7 )
{
if( !LODWORD(v28[1]) )
return 0;
*(_QWORD *)&v30 = a2;
*((_QWORD *)&v29 + 1) = (char *)BaseAddress + LODWORD(v28[1]);
*((_QWORD *)&v30 + 1) = a4;
goto LABEL_8;
}
v14 = RtlCaptureRetpolineImportRvas((char *)BaseAddress, a2, v12, a4, 0i64, (ULONG *)&NumberOfBytes);
v13 = v14;
if( v14 >= 0 )
return(unsigned int)-1073741637;
if( v14 == -1073741789 )
{
PoolWithTag = ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x496C7052ui64);
v9 = PoolWithTag;
if( !PoolWithTag )
return(unsigned int)-1073741801;
v13 = RtlCaptureRetpolineImportRvas((char *)BaseAddress, a2, v12, a4, PoolWithTag, (ULONG *)&NumberOfBytes);
if( v13 < 0 )
goto LABEL_20;
*(_QWORD *)&v29 = v9;
LABEL_8:
v13 = RtlpCaptureDynamicRelocationTableRva(BaseAddress, v12, &a3a);
if( v13 >= 0 )
{
v15 = (char *)BaseAddress + (unsigned int)a3a;
v16 = (unsigned __int64)&v15[*((unsigned int *)v15 + 1) + 8];
for( i = v15 + 8; ; i += *((unsigned int *)i + 2) + 12 )
{
if( (unsigned __int64)i >= v16 )
{
v13 = -1073741637;
goto LABEL_20;
}
if( *(_QWORD *)i == 3i64 )
break;
}
v18 = i + 12;
v19 = (unsigned __int64)&i[*((unsigned int *)i + 2) + 12];
a3a = v19;
if( (unsigned __int64)(i + 12) < v19 )
{
do
{
v20 = (unsigned __int64)v18 + (unsigned int)v18[1];
v21 = (UINT64 *)(v18 + 2);
if( (unsigned __int64)(v18 + 2) < v20 )
{
do
{
if( (*(_DWORD *)v21 & 0xFFF) == 0 && v21 != (UINT64 *)(v18 + 2) )
break;
LODWORD(v24) = 1;
LODWORD(a5a) = *v18;
RtlApplyImportRelocationToImage((UINT64)BaseAddress, v31, (INT64)v28, a6, a5a, v21, v24, a8);
v21 = (UINT64 *)((char *)v21 + 4);
}
while( (unsigned __int64)v21 < v20 );
v19 = a3a;
}
v18 = (_DWORD *)((char *)v18 + (unsigned int)v18[1]);
}
while( (unsigned __int64)v18 < v19 );
v9 = PoolWithTag;
}
v13 = 0;
}
LABEL_20:
if( v9 )
ExFreePoolWithTag(v9, 0);
}
return(unsigned int)v13;
}Referenced by:
MiApplyImportOptimizationToBootDrivers
MiApplyRetpolineFixupsToKernelAndHal