MiCaptureDynamicRelocationTableRva
NTSTATUS __stdcall MiCaptureDynamicRelocationTableRva(
VOID *Base,
UINT64 Size,
INT64 a3,
INT16 a4,
INT64 a5,
INT64 a6,
INT64 a7){
NTSTATUS v7;
unsigned __int16 v8;
int v9;
__int64 v10;
char *v12;
unsigned __int64 v13;
int v14;
__int64 v15;
v15 = 0i64;
v7 = 0;
v8 = 0;
v9 = 0;
v10 = 0i64;
*(_DWORD *)a7 = 0;
if( a4 == 523 )
{
if( (unsigned int)a6 >= 0xE6 )
{
v8 = *(_WORD *)(a5 + 228);
v9 = *(_DWORD *)(a5 + 224);
}
if( (unsigned int)a6 >= 0xC8 )
v10 = *(_QWORD *)(a5 + 192);
}
else
{
if( (unsigned int)a6 >= 0x8E )
{
v8 = *(_WORD *)(a5 + 140);
v9 = *(_DWORD *)(a5 + 136);
}
if( (unsigned int)a6 >= 0x7C )
v10 = *(unsigned int *)(a5 + 120);
}
if( v8 )
{
v12 = (char *)Base + (unsigned int)Size;
v7 = RtlImageNtHeaderEx(0, (unsigned __int64)Base, (unsigned int)Size, &v15);
if( v7 >= 0 )
{
if( v8 > *(_WORD *)(v15 + 6) )
{
return -1073741701;
}
else
{
v13 = *(unsigned __int16 *)(v15 + 20) + v15 + 8 * (5i64 * v8 - 2);
if( (unsigned __int64)v12 <= v13 || (unsigned __int64)v12 < v13 + 40 )
return -1073741701;
else
*(_DWORD *)a7 = v9 + *(_DWORD *)(v13 + 12);
}
}
}
else if( v10 )
{
if( a3 )
v14 = v10 - a3;
else
v14 = v10 - (_DWORD)Base;
*(_DWORD *)a7 = v14;
}
else
{
return -1073741637;
}
return v7;
}Referenced by:
MiApplyDynamicRelocations
MiCaptureBootDriverRetpolineInfo
MiParseImageLoadConfig