| 284 | } |
| 285 | |
| 286 | __int64 __fastcall EAC::Callbacks::IsFileProcessHackerDriver(unsigned __int8 *a1, unsigned __int64 a2) |
| 287 | { |
| 288 | __int64 v4; // rcx |
| 289 | __int64 result; // rax |
| 290 | ULONG v6; // ecx |
| 291 | unsigned int v7; // [rsp+30h] [rbp+8h] BYREF |
| 292 | IMAGE_NT_HEADERS64 *v8; // [rsp+40h] [rbp+18h] BYREF |
| 293 | |
| 294 | v7 = 0; |
| 295 | if ( !a1 || !a2 ) |
| 296 | return 0i64; |
| 297 | sub_14000F6DC(a1, a2, sub_14003F8D8, &v7); |
| 298 | result = v7; |
| 299 | if ( !v7 ) |
| 300 | { |
| 301 | result = EAC::Memory::IncreaseImageSizeWeird(v4, a1, a2); |
| 302 | v7 = result; |
| 303 | if ( !result ) |
| 304 | { |
| 305 | result = sub_14003FE78(a1, a2); |
| 306 | v7 = result; |
| 307 | } |
| 308 | } |
| 309 | if ( result == 9 ) |
| 310 | { |
| 311 | if ( !EAC::Memory::GetPEHeader(a1, 0x1000ui64, 0i64, &v8) ) |
| 312 | return v7; |
| 313 | if ( v8->FileHeader.NumberOfSections != 7 ) |
| 314 | return v7; |
| 315 | if ( v8->OptionalHeader.AddressOfEntryPoint != 0x9064 ) |
| 316 | return v7; |
| 317 | if ( v8->OptionalHeader.SizeOfImage != 0xB000 ) |
| 318 | return v7; |
| 319 | v6 = v8->FileHeader.TimeDateStamp; |
| 320 | if ( v6 != 0x56F975FA && v6 != 0x57089DA8 ) |
| 321 | return v7; |
| 322 | return 0i64; |
| 323 | } |
| 324 | return result; |
| 325 | } |
| 326 | |
| 327 | __int64 __fastcall EAC::Callbacks::MoreDriverChecks(_OWORD *a1) |
| 328 | { |
nothing calls this directly
no outgoing calls
no test coverage detected