RtlCreateInvertedFunctionTableCacheEntry
VOID __fastcall RtlCreateInvertedFunctionTableCacheEntry(VOID *ControlPc, ULONG_PTR a2){
void *ImageBase;
unsigned int SizeOfTable;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v6;
_INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo;
ImageBase = 0i64;
SizeOfTable = 0;
memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
if( ControlPc < *(&byte_140E00020 + 1)
|| ControlPc >= (char *)*(&byte_140E00020 + 1) + *((unsigned int *)&byte_140E00020 + 4) )
{
v6 = RtlpxLookupFunctionTable(ControlPc, &FunctionTableInfo);
}
else
{
v6 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)byte_140E00020;
FunctionTableInfo = *(_INVERTED_FUNCTION_TABLE_ENTRY *)&byte_140E00020;
}
if( v6 )
{
ImageBase = FunctionTableInfo.ImageBase;
SizeOfTable = FunctionTableInfo.SizeOfTable;
}
byte_140E00020 = v6;
*((_DWORD *)&byte_140E00020 + 5) = SizeOfTable;
*(&byte_140E00020 + 1) = ImageBase;
*((_DWORD *)&byte_140E00020 + 4) = a2;
RtlRemoveInvertedFunctionTable(ControlPc);
}Referenced by:
MiInitializeLoadedModuleList