RtlValidateHotPatchBase
char __fastcall RtlValidateHotPatchBase(_DWORD *a1, __int64 a2, unsigned int a3, unsigned int a4){
__int64 v5;
__int64 v6;
int *v7;
int *v8;
unsigned int HotPatchSize;
unsigned int v10;
unsigned int v11;
int v12;
int v13;
unsigned int v15;
v5 = *(unsigned int *)(a2 + 24);
v6 = (unsigned int)a1[1];
if( (unsigned int)v5 < (unsigned int)v6 )
{
v7 = (_DWORD *)((char *)a1 + v6);
v8 = (_DWORD *)((char *)a1 + v5);
HotPatchSize = RtlGetHotPatchSize(a1);
v15 = HotPatchSize;
do
{
LABEL_18:
v13 = *v8;
if( !*v8 )
return 1;
if( v8 >= v7 || (v13 & 0x3FF03000) != 0 || (v13 & 0x40000000) != 0 )
return 0;
if( v13 >= 0 )
{
v11 = a4;
if( (v13 & 0xFC000) != 114688 )
return 0;
}
else
{
v11 = v10;
}
++v8;
v12 = v13 & 0xFFF;
}
while( (v13 & 0xFFF) == 0 );
while( (v13 & 0x4000) == 0 || (unsigned __int64)(unsigned int)v8[1] + 8 <= v11 )
{
if( (v13 & 0x8000) != 0 )
{
if( !RtlDetermineHotPatchExtent((unsigned int)v13) )
return 0;
HotPatchSize = v15;
}
if( (v13 & 0xFC000) == 491520 )
break;
v8 += HotPatchSize;
if( !--v12 )
{
v10 = a3;
goto LABEL_18;
}
}
}
return 0;
}Referenced by:
MiPerformImageHotPatch