-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathIsAncestorOf.cpp
More file actions
50 lines (46 loc) · 1.04 KB
/
IsAncestorOf.cpp
File metadata and controls
50 lines (46 loc) · 1.04 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
/* checks if its a 'ancestor' mostly defined as a char def */
/* works with any execution method and it's 100% inlined! */
//to update this scan this pattern->55 8B EC 64 A1 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 53 56 57 8B 45 08 85 C0
char __thiscall ancestorcall(_DWORD *this, _DWORD *a2)
{
_DWORD *v2; // eax
v2 = a2;
if ( !a2 )
return 0;
while ( 1 )
{
v2 = (_DWORD *)v2[12];
if ( v2 == this )
break;
if ( !v2 )
return 0;
}
return 1;
}
char __thiscall IsAncestorOf(void *this, int a2, volatile signed __int32 *a3)
{
char v3; // bl
void *v4; // eax
if ( a2 )
{
v4 = *(void **)(a2 + 48);
if ( v4 == this )
v3 = 1;
else
v3 = ancestorcall(v4);
}
else
{
v3 = 0;
}
if ( a3 )
{
if ( !_InterlockedExchangeAdd(a3 + 1, 0xFFFFFFFF) )
{
(**(void (__thiscall ***)(volatile signed __int32 *))a3)(a3);
if ( !_InterlockedDecrement(a3 + 2) )
(*(void (__thiscall **)(volatile signed __int32 *))(*a3 + 4))(a3);
}
}
return v3;
}