RtlPcToFileHeader
void *__fastcall RtlPcToFileHeader(void *PcValue, void **BaseOfImage){
void *result;
_INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo;
memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
if( (unsigned __int64)PcValue >= *(&xmmword_140E00020 + 1)
&& (unsigned __int64)PcValue < *(&xmmword_140E00020 + 1) + (unsigned int)qword_140E00030 )
{
*(_OWORD *)&FunctionTableInfo.FunctionTable = *(_OWORD *)&xmmword_140E00020;
}
else
{
RtlpxLookupFunctionTable(PcValue, &FunctionTableInfo);
}
result = FunctionTableInfo.ImageBase;
*BaseOfImage = FunctionTableInfo.ImageBase;
return result;
}Referenced by:
EtwpLocateDbgIdForRegEntry
KeSetTracepoint
KiLockExtendedServiceTable
RtlGuardCheckExceptionHandler
RtlGuardCheckLongJumpTarget