RtlSectionTableFromVirtualAddress
VOID __stdcall RtlSectionTableFromVirtualAddress(PVOID ImageSectionHandle, UINT64 Locking){
unsigned int v2;
char *v3;
unsigned int v4;
unsigned int v5;
unsigned int v6;
unsigned __int64 v7;
v3 = (char *)ImageSectionHandle + *((unsigned __int16 *)ImageSectionHandle + 10) + 24;
v4 = *((unsigned __int16 *)ImageSectionHandle + 3);
if( (unsigned __int64)ImageSectionHandle > 0x7FFFFFFEFFFFi64
|| (unsigned __int64)v3 <= 0x7FFFFFFEFFFFi64
&& (v7 = (unsigned __int64)&v3[40 * *((unsigned __int16 *)ImageSectionHandle + 3)], v7 >= (unsigned __int64)v3)
&& v7 < 0x7FFFFFFEFFFFi64 )
{
v5 = 0;
if( *((_WORD *)ImageSectionHandle + 3) )
{
do
{
v6 = *((_DWORD *)v3 + 3);
if( v2 >= v6 && v2 < *((_DWORD *)v3 + 4) + v6 )
break;
v3 += 40;
++v5;
}
while( v5 < v4 );
}
}
}Referenced by:
CcInitializeBcbProfiler
KeQueryKvaShadowRegion
KiShadowProcessorAllocation
KiTpIsSupportedKernelTracepointLocation
LdrpAccessResourceDataNoMultipleLanguage
RtlAddressInSectionTable