EtwpIsValidImageAddress
CHAR __stdcall EtwpIsValidImageAddress(INT64 a1, INT64 a2, UINT64 *a3){
int v3;
unsigned __int64 v5;
unsigned __int64 v6;
UINT64 v7;
v3 = 0;
v5 = ((unsigned __int64)(a1 & 0xFFF) + a2 + 4095) >> 12;
if( !v5 )
return 1;
v6 = a1 & 0xFFFFFFFFFFFFF000ui64;
while( 1 )
{
v7 = v6 + (unsigned int)(v3 << 12);
if( *a3 != v7 )
break;
LABEL_6:
if( (unsigned int)++v3 >= v5 )
return 1;
}
if( MmIsAddressValidEx(v6 + (unsigned int)(v3 << 12)) )
{
*a3 = v7;
goto LABEL_6;
}
return 0;
}Referenced by:
EtwpFindDebugId