MiMarkKernelCfgAddressTakenImports
INT64 __fastcall MiMarkKernelCfgAddressTakenImports(INT64 a1){
__int64 v2;
__int64 v3;
unsigned int v4;
unsigned int v5;
unsigned int *v6;
unsigned int v7;
__int64 v8;
INT64 result;
UINT64 v10;
LODWORD(v2) = RtlImageDirectoryEntryToData(*(PVOID *)(a1 + 48), 1u, 0xAu, &v10);
v3 = *(_QWORD *)(a1 + 48);
v4 = 0;
v5 = *(_DWORD *)(v2 + 168);
v6 = *(unsigned int **)(v2 + 160);
v7 = (*(_DWORD *)(v2 + 144) >> 28) + 4;
if( v5 )
{
while( 1 )
{
v8 = *v6;
if( (unsigned int)v8 > *(_DWORD *)(a1 + 64) - 8 || (v8 & 7) != 0 )
return 3221225595i64;
result = MiMarkKernelCfgTarget(*(_QWORD *)(v8 + v3));
if( (int)result < 0 )
return result;
++v4;
v6 = (unsigned int *)((char *)v6 + v7);
if( v4 >= v5 )
goto LABEL_6;
}
}
else
{
LABEL_6:
*(_DWORD *)(a1 + 104) |= 0x100u;
return 0i64;
}
}Referenced by:
MiProcessKernelCfgAddressTakenImports