RtlInsertInvertedFunctionTable
NTSTATUS __stdcall RtlInsertInvertedFunctionTable(VOID *ImageBase, INT64 SizeOfImage){
unsigned int v2;
INT64 v4;
NTSTATUS result;
UINT64 v6;
INT64 v7;
UINT8 OldIrql;
UINT64 v9;
v7 = 0i64;
LODWORD(v9) = 0;
v2 = SizeOfImage;
OldIrql = 0;
RtlCaptureImageExceptionValues(ImageBase, (_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY **)&v7, &v9);
MmLockLoadedModuleListExclusive(&OldIrql);
LODWORD(v6) = v9;
RtlpInsertInvertedFunctionTableEntry(v4, (UINT64)ImageBase, v7, v2, v6);
ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
result = OldIrql;
__writecr8(OldIrql);
return result;
}Referenced by:
MiProcessLoaderEntry