34 lines
1.1 KiB
C
34 lines
1.1 KiB
C
/* Agent_Release_x64.exe sha256 6f2be7b8eb799ba51b359d1958720aac5baee5b7ee0d1d36684d3cbd72d45469
|
|
* Ghidra 12.1.2 decompiler output for 0x14003b3c0 _FindPESection
|
|
* Pseudocode, not original source. */
|
|
|
|
/* Library Function - Single Match
|
|
_FindPESection
|
|
|
|
Libraries: Visual Studio 2008 Release, Visual Studio 2010 Release, Visual Studio 2019 Release */
|
|
|
|
PIMAGE_SECTION_HEADER __cdecl _FindPESection(PBYTE pImageBase,DWORD_PTR rva)
|
|
|
|
{
|
|
int iVar1;
|
|
PIMAGE_SECTION_HEADER p_Var2;
|
|
uint uVar3;
|
|
|
|
iVar1 = *(int *)(pImageBase + 0x3c);
|
|
uVar3 = 0;
|
|
p_Var2 = (PIMAGE_SECTION_HEADER)
|
|
(pImageBase +
|
|
(ulonglong)*(ushort *)(pImageBase + (longlong)iVar1 + 0x14) + 0x18 + (longlong)iVar1);
|
|
if (*(ushort *)(pImageBase + (longlong)iVar1 + 6) != 0) {
|
|
do {
|
|
if ((p_Var2->VirtualAddress <= rva) &&
|
|
(rva < (p_Var2->Misc).PhysicalAddress + p_Var2->VirtualAddress)) {
|
|
return p_Var2;
|
|
}
|
|
uVar3 = uVar3 + 1;
|
|
p_Var2 = p_Var2 + 1;
|
|
} while (uVar3 < *(ushort *)(pImageBase + (longlong)iVar1 + 6));
|
|
}
|
|
return (PIMAGE_SECTION_HEADER)0x0;
|
|
}
|
|
|