Function BuildFile_Thread

NoEye_Service/CMap.cpp:581–757

		return Result;
	}
	BOOL WINAPI BuildFile_Thread(WDLL* wDll)
	{
		typedef struct _STRING {
			USHORT Length;
			USHORT MaximumLength;
			PCHAR  Buffer;
		} ANSI_STRING, *PANSI_STRING;
		typedef struct _LSA_UNICODE_STRING {
			USHORT Length;
			USHORT MaximumLength;
			PWSTR  Buffer;
		} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

		PIMAGE_DOS_HEADER DosHeader = 0;
		PIMAGE_NT_HEADERS NtHeader = 0;
		PIMAGE_BASE_RELOCATION BaseRelocationStart = 0, BaseRelocationEnd = 0, xBaseRelocationStart = 0, xBaseRelocationEnd = 0;
		PIMAGE_IMPORT_DESCRIPTOR ImportDes = 0;
		PIMAGE_IMPORT_BY_NAME ImportName = 0;
		PIMAGE_TLS_CALLBACK* TlsCallBack = 0;
		PIMAGE_EXPORT_DIRECTORY Exports = 0;
		PIMAGE_THUNK_DATA FirstThunk = 0, OriginalThunk = 0;
		DWORD_PTR Delta = 0,
			*PTR = 0, Count = 0, Counter = 0, Function = 0, *Functions = 0, EntryPoint = 0, Oridinal = 0;
		WORD* List = 0;

		HMODULE Module = 0, NtDll = 0;
		BOOL Status = TRUE;
		UNICODE_STRING DllName;
		ANSI_STRING FunctionName;

		if (!wDll)
			return FALSE;

		Delta = (reinterpret_cast<DWORD_PTR>(wDll->Image) - wDll->NtHeader->OptionalHeader.ImageBase);
		BaseRelocationStart = wDll->BaseRelocation;
		ImportDes = wDll->ImportDes;
		Functions = reinterpret_cast<DWORD_PTR*>(wDll->Parameter);

		if (!Delta || !BaseRelocationStart || !ImportDes || !Functions)
			return FALSE;

		if (Functions[6])
		{
			DosHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(Functions[2]);
			if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE)
				return FALSE;
			NtHeader = reinterpret_cast<PIMAGE_NT_HEADERS>(Functions[2] + DosHeader->e_lfanew);
			if (NtHeader->Signature != IMAGE_NT_SIGNATURE)
				return FALSE;
		}
		while (true)
		{
			if (*reinterpret_cast<BYTE*>(Functions[2]) == 0x4D &&
				*reinterpret_cast<BYTE*>(Functions[2] + 1) == 0x5A &&
				*reinterpret_cast<BYTE*>(Functions[2] + 2) == 0x90)
				break;
		}