RtlGetImageBaseAndLoadConfig
INT64 __fastcall RtlGetImageBaseAndLoadConfig(UINT64 a1, PVOID *a2, INT64 *a3){
INT64 v3;
INT64 v7;
UINT64 v9;
unsigned __int64 a3a;
UINT64 v11;
_INVERTED_FUNCTION_TABLE_ENTRY BaseAddress;
INT64 a4;
*(_QWORD *)&BaseAddress.SizeOfImage = 0i64;
v7 = 0i64;
LODWORD(a4) = 0;
if( !RtlpLookupUserFunctionTableInverted((VOID *)a1, &BaseAddress, (INT64)a3, v3, 0i64, v11, 0i64, 0i64) )
{
if( (int)MmGetImageInformation(a1, &BaseAddress.ImageBase, &a3a, &a4) < 0 )
{
BaseAddress.ImageBase = 0i64;
}
else if( a3a >= 0xFFFFFFFF )
{
return 3221225621i64;
}
}
v11 = 0i64;
if( BaseAddress.ImageBase )
{
if( (unsigned __int64)BaseAddress.ImageBase + 64 > 0x7FFFFFFF0000i64
|| (void *)((unsigned __int64)BaseAddress.ImageBase + 64) < BaseAddress.ImageBase )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
LODWORD(v9) = LdrImageDirectoryEntryToLoadConfig(BaseAddress.ImageBase);
v7 = v9;
v11 = v9;
}
*a2 = BaseAddress.ImageBase;
*a3 = v7;
return 0i64;
}Referenced by:
KiVerifyContextIpForUserCet
RtlVerifyUserUnwindTarget