MiCaptureDynamicRelocationTableRva
INT64 __fastcall MiCaptureDynamicRelocationTableRva(
PVOID Base,
UINT64 Size,
INT64 a3,
INT16 a4,
INT64 a5,
INT64 a6,
INT64 a7){
NTSTATUS v7;
unsigned __int16 v8;
int v9;
__int64 v10;
char *v12;
char *v13;
int v14;
PIMAGE_NT_HEADERS NtHeader;
NtHeader = 0i64;
v7 = 0;
v8 = 0;
v9 = 0;
v10 = 0i64;
*(_DWORD *)a7 = 0;
if( a4 == 523 )
{
if( (unsigned int)a6 >= 0xE6 )
{
v8 = *(_WORD *)(a5 + 228);
v9 = *(_DWORD *)(a5 + 224);
}
if( (unsigned int)a6 >= 0xC8 )
v10 = *(_QWORD *)(a5 + 192);
}
else
{
if( (unsigned int)a6 >= 0x8E )
{
v8 = *(_WORD *)(a5 + 140);
v9 = *(_DWORD *)(a5 + 136);
}
if( (unsigned int)a6 >= 0x7C )
v10 = *(unsigned int *)(a5 + 120);
}
if( v8 )
{
v12 = (char *)Base + (unsigned int)Size;
v7 = RtlImageNtHeaderEx(0i64, Base, (unsigned int)Size, &NtHeader);
if( v7 >= 0 )
{
if( v8 > NtHeader->FileHeader.NumberOfSections )
{
return(unsigned int)-1073741701;
}
else
{
v13 = (char *)NtHeader + 40 * v8 + NtHeader->FileHeader.SizeOfOptionalHeader - 16;
if( v12 <= v13 || v12 < v13 + 40 )
return(unsigned int)-1073741701;
else
*(_DWORD *)a7 = v9 + *((_DWORD *)v13 + 3);
}
}
}
else if( v10 )
{
if( a3 )
v14 = v10 - a3;
else
v14 = v10 - (_DWORD)Base;
*(_DWORD *)a7 = v14;
}
else
{
return(unsigned int)-1073741637;
}
return(unsigned int)v7;
}Referenced by:
MiApplyDynamicRelocations
MiCaptureBootDriverRetpolineInfo
MiParseImageLoadConfig