MiLogRelocationRva
void __fastcall MiLogRelocationRva(unsigned int a1, unsigned int a2, _QWORD *a3, __int64 a4){
__int64 v5;
__int16 v6;
_SUBSECTION *v7;
unsigned __int64 v8;
unsigned __int64 v9;
unsigned int v10;
unsigned __int64 v11;
INT64 v12;
__int64 v13[3];
v13[0] = 0i64;
v5 = a2;
v6 = a1;
v7 = MiOffsetToProtos((_CONTROL_AREA *)a4, a1, (UINT64 *)v13);
if( v7 )
{
v8 = (v13[0] << 12) + ((unsigned __int64)*((unsigned int *)v7 + 9) << 9);
if( (PfSnNumActiveTraces || dword_140CEBED8) && (int)PsGetIoPriorityThread((__int64)KeGetCurrentThread()) >= 2 )
{
v9 = ((unsigned __int64)(v6 & 0xFFF) + v5 + 4095) >> 12;
v10 = v9 + 1;
if( (v8 & 0xFFF) == 0 )
v10 = v9;
v11 = v8 & 0xFFFFFFFFFFFFF000ui64;
if( dword_140CEBED8 )
{
LODWORD(v12) = 0;
PfLogFileDataAccess(a3[3], (INT64)KeGetCurrentThread(), v11, v10, v12);
}
if( PfSnNumActiveTraces && v10 )
{
do
{
PfSnLogPageFault((FILE_OBJECT *)a3, v11, 2ui64);
v11 += 4096i64;
--v10;
}
while( v10 );
}
}
}
}Referenced by:
MiCaptureImageCfgContext
MiLogRelocationFaults
MiParseComAndCetHeaders
MiParseImageLoadConfig