KiTpIsSupportedKernelTracepointLocation

BOOL __stdcall KiTpIsSupportedKernelTracepointLocation(UINT64 Address, ULONGLONG Maximum){
  unsigned __int64 v4; 
  unsigned __int64 v5; 
  int v6; 
  char v7; 

  LODWORD(v4) = RtlImageNtHeader(Address);
  if( !v4 )
    return 0;
  v5 = RtlSectionTableFromVirtualAddress(v4, Address, (int)Maximum - (int)Address);
  if( !v5 )
    return 0;
  if( (*(_DWORD *)(v5 + 36) & 0x2000020) != 32 )
    return 0;
  v6 = *(_DWORD *)v5;
  if( *(_DWORD *)v5 == 1414090313 || v6 == 1396790859 )
    return 0;
  if( v6 == 1162297680 && *(_DWORD *)(v5 + 4) )
  {
    v7 = *(_BYTE *)(v5 + 4);
    if( v7 == 119 )
    {
      if( *(_BYTE *)(v5 + 5) == 120 )
        return 0;
    }
    else if( v7 == 86 && *(_BYTE *)(v5 + 5) == 82 && *(_BYTE *)(v5 + 6) == 70 )
    {
      return 0;
    }
  }
  return(PVOID)Address != PsHalImageBase
      && (Address != PsNtosImageBase
       || v6 != 1128354388 && v6 != 1347769157 && !KiTpIsExcludedKernelTracepointLocation(Maximum));
}

Referenced by: