|
|
RAWPACKQT__VERFINDFILEA_lpdwCurDirLen macro iOffset, iTempOffset local nullpointer
; We'll just clear out the HIWORD of the UINT on entrance, and not worry about ; it on exit, since this value is undefined on failure of the function. mov eax,dword ptr [ebp + iOffset] or eax,eax jz nullpointer mov word ptr [eax+2],0 nullpointer: push eax call MapLS mov [ebp + iTempOffset], eax
endm
RAWUNPACKQT__VERFINDFILEA_lpdwCurDirLen macro iOffset, iTempOffset
push eax push [ebp + iTempOffset] call UnMapLS pop eax
endm
RAWPACKQT__VERFINDFILEA_lpdwDestDirLen macro iOffset, iTempOffset local nullpointer
; We'll just clear out the HIWORD of the UINT on entrance, and not worry about ; it on exit, since this value is undefined on failure of the function. mov eax,dword ptr [ebp + iOffset] or eax,eax jz nullpointer mov word ptr [eax+2],0 nullpointer: push eax call MapLS mov [ebp + iTempOffset], eax
endm
RAWUNPACKQT__VERFINDFILEA_lpdwDestDirLen macro iOffset, iTempOffset
push eax push [ebp + iTempOffset] call UnMapLS pop eax
endm
RAWPACKQT__VERINSTALLFILEA_lpwTmpFileLen macro iOffset, iTempOffset local nullpointer
; We'll just clear out the HIWORD of the UINT on entrance, and not worry about ; it on exit, since this value is undefined on failure of the function. mov eax,dword ptr [ebp + iOffset] or eax,eax jz nullpointer mov word ptr [eax+2],0 nullpointer: push eax call MapLS mov [ebp + iTempOffset], eax
endm
RAWUNPACKQT__VERINSTALLFILEA_lpwTmpFileLen macro iOffset, iTempOffset
push eax push [ebp + iTempOffset] call UnMapLS pop eax
endm
RAWPACKQT__VERQUERYVALUEA_lplpBuffer macro iOffset, iTempOffset
local ebp_pBlock
ebp_pBlock equ [ebp_qttop]
mov eax,ebp_pBlock mov LOCAL__VERQUERYVALUEA_pBlock32, eax push dword ptr [ebp + iOffset] call MapLS mov LOCAL__VERQUERYVALUEA_lplpBufTemp, eax mov [ebp + iTempOffset], eax endm
RAWUNPACKQT__VERQUERYVALUEA_lplpBuffer macro iOffset, iTempOffset local exit local ebp_pBlock
ebp_pBlock equ [ebp_qttop]
push eax push dword ptr LOCAL__VERQUERYVALUEA_lplpBufTemp call UnMapLS pop eax
or eax,eax jz exit
; HACK! We know that the api returns a pointer inside pBlock. ; The thunk passed in a 16:16 pointer where the offset is 0 for pBlock ; (because that's how MapLS works.) So we can deduce the linear ; address by looking just at the offset. ; ; The code generator has already unmapped the selector, so don't use it! mov ecx, [ebp + iOffset] movzx edx, word ptr [ecx] add edx, dword ptr LOCAL__VERQUERYVALUEA_pBlock32 mov [ecx], edx
exit: endm
RAWPACKQT__VERQUERYVALUEA_lpwLen macro iOffset, iTempOffset local nullpointer
; We'll just clear out the HIWORD of the UINT on entrance, and not worry about ; it on exit, since this value is undefined on failure of the function. mov eax,dword ptr [ebp + iOffset] or eax,eax jz nullpointer mov word ptr [eax+2],0 nullpointer: push eax call MapLS mov [ebp + iTempOffset], eax
endm
RAWUNPACKQT__VERQUERYVALUEA_lpwLen macro iOffset, iTempOffset
push eax push [ebp + iTempOffset] call UnMapLS pop eax
endm
|