same save/restore shape as the inline wrapper but the body is CreateThread, NULL, 0, vm_blob, NULL, 0, NULL through the iat slot
| 381 | // same save/restore shape as the inline wrapper but the body is |
| 382 | // CreateThread, NULL, 0, vm_blob, NULL, 0, NULL through the iat slot |
| 383 | struct ThreadedFixups { |
| 384 | std::size_t call_iat_disp32_off{0}; // disp32 in call qword ptr [rip + disp32] |
| 385 | std::size_t lea_blob_disp32_off{0}; // disp32 in lea r8, [rip + blob] |
| 386 | }; |
| 387 | WrapperLayout emit_wrapper_x64_threaded(const std::uint8_t* displaced, |
| 388 | std::uint32_t dlen, |
| 389 | ThreadedFixups& fx) { |
nothing calls this directly
no outgoing calls
no test coverage detected