RtlWcpDllDebugEntrypoint

来源:互联网 发布:淘宝专业删差评 编辑:程序博客网 时间:2024/06/05 14:51

RtlWcpDllDebugEntrypoint

调试入口。//----- (10121A70) --------------------------------------------------------int __stdcall RtlWcpDllDebugEntrypoint(int a1, int a2){  struct Windows::Rtl::IRtlSystemIsolationLayer *v8; // [sp+0h] [bp-Ch]@0  v2 = 0;  if ( !*(_DWORD *)(a2 + 4) )    return 0;  v3 = 0;  while ( 1 )  {    v4 = *(_DWORD *)a2;    v5 = *(_DWORD *)(v3 + *(_DWORD *)a2);    if ( !v5 )    {      result = WcpDllDebug::RtlpSetSystem(0, *(_DWORD *)(v3 + v4 + 8), v8);      if ( result < 0 )        return result;      goto LABEL_9;    }    v6 = v5 - 2;    if ( !v6 )    {      pfnPrimitiveOperationExecutor = *(_DWORD *)(v3 + v4 + 4);      goto LABEL_9;    }    if ( v6 != 1 )      return -1073741822;    Windows::ComponentStore::Rtl::Implementation::g_SequentialLockIdentifiers = *(_BYTE *)(v3 + v4 + 4);LABEL_9:    ++v2;    v3 += 12;    if ( v2 >= *(_DWORD *)(a2 + 4) )      return 0;  }}// 1027B168: using guessed type int pfnPrimitiveOperationExecutor;// 1027D5E0: using guessed type bool Windows::ComponentStore::Rtl::Implementation::g_SequentialLockIdentifiers;//----- (100EB570) --------------------------------------------------------int __stdcall WcpDllDebug::RtlpSetSystem(WcpDllDebug *this, unsigned __int32 a2, struct Windows::Rtl::IRtlSystemIsolationLayer *a3){  signed __int32 v3; // edi@1  int v4; // esi@2  void (__thiscall ***v6)(_DWORD); // edi@5  void (__thiscall *v7)(_DWORD); // esi@6  signed __int32 v8; // [sp+8h] [bp-8h]@1  v3 = 0;  v8 = 0;  if ( a2 )  {    v4 = Windows::Rtl::IRtlObject::CreateRequiredInterface<Windows::Rtl::IRtlSystemIsolationLayer>(           (void *)a2,           (int *)&v8);    if ( v4 < 0 )    {      Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v8);      return v4;    }    v3 = v8;  }  v6 = (void (__thiscall ***)(_DWORD))_InterlockedExchange(                                        (volatile signed __int32 *)&Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest,                                        v3);  v8 = 0;  if ( v6 )  {    v7 = **v6;    __guard_check_icall_fptr(**v6);    v7(v6);  }  Windows::AutoPointerBase<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *,Windows::Auto<Windows::Cdf::Rtl::IRtlCdfStringTableEnumerator *>>::Close(&v8);  return 0;}// 1027D610: using guessed type struct Windows::Rtl::IRtlSystemIsolationLayer *Windows::Rtl::SystemImplementation::g_pSystemIsolationLayerFromTest;
0 0
原创粉丝点击