RtlpInsertInvertedFunctionTableEntry
NTSTATUS __stdcall RtlpInsertInvertedFunctionTableEntry(INT64 a1, UINT64 a2, INT64 a3, INT64 a4, UINT64 a5){
NTSTATUS result;
int v6;
unsigned int v9;
UINT64 *v10;
__int64 v11;
result = PsInvertedFunctionTable[0];
v6 = a4;
if( PsInvertedFunctionTable[0] == dword_140E00014 )
{
byte_140E0001C = 1;
}
else
{
_InterlockedIncrement(&dword_140E00018);
v9 = 1;
if( PsInvertedFunctionTable[0] != 1 )
{
if( PsInvertedFunctionTable[0] > 1u )
{
v10 = (UINT64 *)&unk_140E00040;
do
{
if( a2 < *v10 )
break;
++v9;
v10 += 3;
}
while( v9 < PsInvertedFunctionTable[0] );
}
if( v9 != PsInvertedFunctionTable[0] )
memmove(
&PsInvertedFunctionTable[4 * v9 + 10 + 2 * v9],
&PsInvertedFunctionTable[4 * v9 + 4 + 2 * v9],
24 * (PsInvertedFunctionTable[0] - v9));
}
v11 = 3i64 * v9;
result = a5;
*(_QWORD *)&PsInvertedFunctionTable[2 * v11 + 4] = a3;
*(_QWORD *)&PsInvertedFunctionTable[2 * v11 + 6] = a2;
PsInvertedFunctionTable[2 * v11 + 8] = v6;
PsInvertedFunctionTable[2 * v11 + 9] = a5;
++PsInvertedFunctionTable[0];
_InterlockedIncrement(&dword_140E00018);
}
return result;
}Referenced by:
RtlInsertInvertedFunctionTable