MiCaptureRetpolineRelocationTables
INT64 __fastcall MiCaptureRetpolineRelocationTables(CHAR *a1, UINT64 a2, INT64 a3, UINT64 a4, UINT64 *a5){
unsigned __int64 v5;
unsigned __int64 v6;
CHAR *v7;
__int64 v8;
UINT64 *v9;
unsigned int v10;
unsigned int v11;
unsigned int v12;
__int64 v13;
__int64 v14;
unsigned int v15;
UINT8 **v16;
int v17;
UINT8 *v19;
UINT8 *v20;
UINT64 v21;
__int64 v22;
unsigned int a2a;
int a3a;
a2a = a2;
v5 = (unsigned int)a4;
v6 = (unsigned int)a2;
v7 = a1;
v22 = 0i64;
a3a = 0;
LODWORD(v8) = RtlImageDirectoryEntryToData(a1, 1u, 0xCu, &v21);
v9 = a5;
if( v8 )
{
v10 = v8 - (_DWORD)v7;
*(_DWORD *)a5 = v10;
if( v10 > (unsigned int)v6 )
goto LABEL_31;
}
else
{
*(_DWORD *)a5 = 0;
}
if( v5 + 8 >= v5 && v5 + 8 <= v6 )
{
v21 = *(_QWORD *)&v7[v5];
v11 = HIDWORD(v21) + v5 + 8;
if( v11 >= (unsigned int)v5 && v11 <= (unsigned int)v6 )
{
if( (_DWORD)v21 != 1 )
{
v17 = -1073741637;
goto LABEL_32;
}
v12 = v5 + 8;
while( 1 )
{
if( v12 >= v11 )
{
v17 = 0;
goto LABEL_20;
}
if( (unsigned __int64)v12 + 12 > v11 )
break;
v13 = (__int64)&v7[v12];
v22 = v13;
v21 = *(_QWORD *)v13;
v14 = *(unsigned int *)(v13 + 8);
v15 = v14 + v12 + 12;
if( v15 < v12 || v15 > v11 )
break;
if( v21 == 3 )
{
v16 = (UINT8 **)(v9 + 1);
}
else
{
if( v21 == 4 )
{
if( MiIsRetpolineEnabled() )
{
v16 = (UINT8 **)(v9 + 2);
goto LABEL_17;
}
}
else if( v21 == 5 && MiIsRetpolineEnabled() )
{
v16 = (UINT8 **)(v9 + 3);
goto LABEL_17;
}
v16 = 0i64;
}
LABEL_17:
if( v16 )
{
if( *v16 )
break;
LODWORD(v19) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
*v16 = v19;
if( !v19 )
{
v17 = -1073741670;
goto LABEL_32;
}
memmove(v19, (UINT8 *)v13, v14 + 12);
v20 = *v16;
*(_QWORD *)v20 = v21;
*((_DWORD *)v20 + 2) = v14;
v17 = RtlValidateRetpolineRelocation(*v16, a2a, &a3a);
if( v17 < 0 )
goto LABEL_20;
*((_DWORD *)v9 + 1) += a3a;
v12 = v15;
v7 = a1;
}
else
{
v12 = v15;
}
}
}
LABEL_31:
v17 = -1073741701;
goto LABEL_32;
}
v17 = -1073741701;
LABEL_20:
if( v17 < 0 )
LABEL_32:
MiFreeImageRetpolineContext(v9);
return(unsigned int)v17;
}Referenced by:
MiCaptureBootDriverRetpolineInfo
MiParseImageLoadConfig