RtlVerifyUserUnwindTarget
INT64 __fastcall RtlVerifyUserUnwindTarget(UINT64 a1, INT64 a2, INT64 a3){
int v4;
INT64 result;
unsigned __int64 v7;
int v8;
__int64 v9;
unsigned int v10;
unsigned __int64 v11;
char *v12;
unsigned __int64 v13;
unsigned __int64 v14;
unsigned int v15;
unsigned __int64 v16;
unsigned __int64 v17;
char *v18;
unsigned __int64 v19;
int Key;
v4 = a2;
v17 = 0i64;
v16 = 0i64;
Key = 0;
result = RtlGetImageBaseAndLoadConfig(a1, (PVOID *)&v16, (INT64 *)&v17);
if( (int)result >= 0 )
{
v7 = v17;
if( a3 )
{
*(_BYTE *)(a3 + 16) = 1;
*(_QWORD *)a3 = v16;
*(_QWORD *)(a3 + 8) = v7;
}
if( v16 )
{
v8 = 0x10000;
if( v4 != 2 )
v8 = 0x400000;
v9 = 192i64;
if( v4 != 2 )
v9 = 280i64;
v10 = v9;
v11 = v7 + v9;
if( v11 > 0x7FFFFFFF0000i64 || v11 < v7 )
MEMORY[0x7FFFFFFF0000] = 0;
if( !v7 || *(_DWORD *)v7 < v10 || (v8 & *(_DWORD *)(v7 + 144)) == 0 )
return 0i64;
if( v4 == 2 )
{
v12 = *(char **)(v7 + 176);
v18 = v12;
v13 = *(_QWORD *)(v7 + 184);
v19 = v13;
if( v13 >= 0xFFFFFFFF )
return 3221225621i64;
}
else
{
v12 = *(char **)(v7 + 264);
v18 = v12;
if( (unsigned __int64)v12 <= v16 )
return 0i64;
v13 = *(_QWORD *)(v7 + 272);
v19 = v13;
if( v13 >= 0xFFFFFFFF )
return 3221225621i64;
}
if( v13 )
{
Key = a1 - v16;
v15 = (*(_DWORD *)(v7 + 144) >> 28) + 4;
if( v13 > 0xFFFFFFFFFFFFFFFFui64 / v15 )
return 3221225621i64;
v14 = v13 * v15;
if( v14 && ((unsigned __int64)&v12[v14] > 0x7FFFFFFF0000i64 || &v12[v14] < v12) )
MEMORY[0x7FFFFFFF0000] = 0;
if( bsearch_s(
&Key,
v12,
v13,
v15,
(int(__cdecl *)(void *, const void *, const void *))RtlpTargetCompare,
0i64) )
{
return 0i64;
}
}
}
if( v4 || !RtlpFindDynamicEHContinuationTarget(a1) )
return 3221227018i64;
else
return 0i64;
}
return result;
}Referenced by:
KiVerifyContextIpForUserCet