TriageGetLoaderEntry
_KLDR_DATA_TABLE_ENTRY *__stdcall TriageGetLoaderEntry(VOID *TriageDumpBlock, UINT64 ModuleIndex){
__int64 v2;
char *v4;
__int64 v5;
_KLDR_DATA_TABLE_ENTRY *result;
unsigned __int16 v7;
v2 = (unsigned int)ModuleIndex;
if( !TriagepVerifyDump(TriageDumpBlock)
|| (unsigned int)v2 >= *(_DWORD *)((char *)TriageDumpBlock + (unsigned int)TriageImagePageSize + 52) )
{
return 0i64;
}
_mm_lfence();
v4 = (char *)TriageDumpBlock + *(unsigned int *)((char *)TriageDumpBlock + (unsigned int)TriageImagePageSize + 48);
v5 = *(unsigned int *)&v4[144 * v2];
result = (_KLDR_DATA_TABLE_ENTRY *)&v4[144 * v2 + 8];
v7 = 2 * *(_WORD *)((char *)TriageDumpBlock + v5);
result->BaseDllName.Length = v7;
result->BaseDllName.MaximumLength = v7;
result->BaseDllName.Buffer = (wchar_t *)((char *)TriageDumpBlock + v5 + 4);
return result;
}Referenced by:
VfTriageAddDrivers
ViTriageSameDriversFromDump