KiVerifyPdata
VOID __stdcall KiVerifyPdata(PVOID ControlPc){
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v2;
unsigned int SizeOfTable;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v4;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *BugCheckParameter4;
_INVERTED_FUNCTION_TABLE_ENTRY FunctionTableInfo;
memset(&FunctionTableInfo, 0, sizeof(FunctionTableInfo));
if( ControlPc < *(&byte_140E00020 + 1)
|| ControlPc >= (char *)*(&byte_140E00020 + 1) + *((unsigned int *)&byte_140E00020 + 4) )
{
v2 = RtlpxLookupFunctionTable(ControlPc, &FunctionTableInfo);
}
else
{
v2 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)byte_140E00020;
*(_QWORD *)&FunctionTableInfo.SizeOfImage = *(&byte_140E00020 + 2);
}
SizeOfTable = 0;
if( v2 )
SizeOfTable = FunctionTableInfo.SizeOfTable;
if( v2 )
{
if( SizeOfTable % 0xCui64 )
KeBugCheckEx(0x14Du, (PVOID)0xFFFFFFFDi64, ControlPc, (PVOID)SizeOfTable, 0i64);
v4 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v2 + 12 * (SizeOfTable / 0xC));
BugCheckParameter4 = 0i64;
while( v2 != v4 )
{
if( BugCheckParameter4 )
{
if( BugCheckParameter4->BeginAddress >= v2->BeginAddress )
KeBugCheckEx(0x14Du, (PVOID)0xFFFFFFFEi64, ControlPc, v2, BugCheckParameter4);
}
BugCheckParameter4 = v2;
v2 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v2 + 12);
}
}
}Referenced by:
KiVerifyScopesExecute