RtlMarkExceptionHandlingPages
NTSTATUS __stdcall RtlMarkExceptionHandlingPages(
UINT64 ImageBase,
UINT64 ImageSize,
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *FunctionTable,
UINT64 SizeOfTable,
_RTL_BITMAP *ImagePages){
UINT64 v6;
char *v8;
unsigned int v9;
unsigned int v10;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v11;
ULONG BeginAddress;
unsigned int *i;
int v14;
_BYTE *v15;
int v16;
bool v17;
unsigned int v18;
__int64 v19;
char v20;
_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v22;
UINT64 v23;
char *v24;
v6 = ImageBase + (unsigned int)ImageSize;
if( (unsigned __int64)FunctionTable >= ImageBase )
{
v8 = (char *)FunctionTable + (unsigned int)SizeOfTable;
v24 = v8;
if( (unsigned __int64)v8 <= v6 )
{
v9 = (unsigned int)SizeOfTable / 0xC;
if( (unsigned int)SizeOfTable == 12 * ((unsigned int)SizeOfTable / 0xCui64) )
{
RtlSetBits(
ImagePages,
(unsigned int)(((unsigned __int64)FunctionTable - ImageBase) >> 12),
(unsigned int)(((unsigned __int64)&FunctionTable[511].1 + (unsigned int)SizeOfTable - ImageBase + 3) >> 12)
- (unsigned int)(((unsigned __int64)FunctionTable - ImageBase) >> 12));
v10 = 0;
if( !v9 )
return 0;
v11 = FunctionTable;
LABEL_6:
BeginAddress = v11[1].BeginAddress;
for( i = (unsigned int *)v11; (BeginAddress & 1) != 0; BeginAddress = i[2] )
{
LODWORD(v23) = RtlpConvertFunctionEntry((INT64)i, ImageBase);
i = (unsigned int *)v23;
if( v23 >= (unsigned __int64)FunctionTable && v23 + 12 <= (unsigned __int64)v8 )
break;
if( v23 < ImageBase || v23 > v6 - 12 )
return -1073741569;
RtlSetBits(
ImagePages,
(unsigned int)((v23 - ImageBase) >> 12),
(unsigned int)((unsigned __int64)(((_WORD)v23 - (_WORD)ImageBase) & 0xFFF) + 12 > 0x1000) + 1);
}
v14 = 0;
while( 1 )
{
v15 = (_BYTE *)(ImageBase + i[2]);
if( (unsigned __int64)v15 < ImageBase || (unsigned __int64)(v15 + 6) > v6 )
break;
v16 = (unsigned __int8)v15[2];
v17 = (v16 & 1) == 0;
v18 = 2 * v16 + 6;
v19 = (unsigned int)(2 * v16 + 8);
if( v17 )
v19 = v18;
v20 = *v15 >> 3;
if( (v20 & 4) != 0 )
{
v19 = (unsigned int)(v19 + 12);
}
else if( (v20 & 3) != 0 )
{
v19 = (unsigned int)(v19 + 8);
}
if( (unsigned __int64)&v15[v19] > v6 )
break;
RtlSetBits(
ImagePages,
(unsigned int)((unsigned __int64)&v15[-ImageBase] >> 12),
(unsigned int)((unsigned __int64)&v15[(unsigned int)v19 + 4095 - ImageBase] >> 12)
- (unsigned int)((unsigned __int64)&v15[-ImageBase] >> 12));
if( (*v15 & 0x20) != 0 )
{
if( (unsigned int)++v14 > 0x20 )
return -1073741569;
i = (unsigned int *)&v15[2 * (((unsigned __int8)v15[2] + 1i64) & 0xFFFFFFFFFFFFFFFEui64) + 4];
v22 = RtlpSearchFunctionTable(FunctionTable, v9, ImageBase + *i, ImageBase);
if( !v22 || v22[1].BeginAddress != i[2] )
continue;
}
v8 = v24;
++v10;
v11 = (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *)((char *)v11 + 12);
if( v10 < v9 )
goto LABEL_6;
return 0;
}
}
}
}
return -1073741569;
}Referenced by:
MiCaptureImageExceptionValues