构造函数与分配空间
构造函数就是分配空间,并进行初始化。
在 32 位下,CSystemIsolationLayer::CSystemIsolatio() ,
在 64 位下,Windows::Auto< CSystemIsolationLayer *>::Allocate()
//----- (100E3453) --------------------------------------------------------
Windows::Rtl::SystemImplementation::CSystemIsolationLayer *__thiscall Windows::Rtl::SystemImplementation::CSystemIsolationLayer::CSystemIsolationLayer(
Windows::Rtl::SystemImplementation::CSystemIsolationLayer *this)
{
*(_DWORD *)this = &Windows::Rtl::CRtlObjectBase<MicrodomImplementation::CMicrodom>::`vftable';
*((_DWORD *)this + 1) = 0;
*(_DWORD *)this = &Windows::Rtl::SystemImplementation::CSystemIsolationLayer::`vftable';
*((_DWORD *)this + 4) = 0;
*((_DWORD *)this + 5) = 0;
*((_DWORD *)this + 6) = 0;
*((_DWORD *)this + 7) = 0;
*((_DWORD *)this + 9) = 0;
*((_DWORD *)this + 10) = 0;
*((_DWORD *)this + 11) = 0;
*((_DWORD *)this + 12) = 0;
*((_DWORD *)this + 13) = 0;
*((_DWORD *)this + 14) = 0;
return this;
}
// 100068E4: using guessed type int (__stdcall *Windows::Rtl::CRtlObjectBase<MicrodomImplementation::CMicrodom>::`vftable')(char);
// 10033A54: using guessed type int (__thiscall *Windows::Rtl::SystemImplementation::CSystemIsolationLayer::`vftable')(PVOID Address, char);
//----- (00000001800697A4) ----------------------------------------------------
int __fastcall Windows::Auto<Windows::Rtl::SystemImplementation::CSystemIsolationLayer *>::Allocate(_QWORD *a1)
{
_QWORD *v1; // rbx@1
__int64 v2; // rax@1
v1 = a1;
LODWORD(v2) = RtlAllocateHeap(*(_QWORD *)(*MK_FP(__GS__, 96i64) + 48i64), 0i64, 120i64);
if ( v2 )
{
*(_QWORD *)v2 = Windows::Rtl::CRtlObjectBase<MicrodomImplementation::CMicrodom>::`vftable';
*(_QWORD *)v2 = Windows::Rtl::SystemImplementation::CSystemIsolationLayer::`vftable';
*(_DWORD *)(v2 + 8) = 0;
*(_QWORD *)(v2 + 32) = 0i64;
*(_QWORD *)(v2 + 40) = 0i64;
*(_QWORD *)(v2 + 48) = 0i64;
*(_QWORD *)(v2 + 56) = 0i64;
*(_QWORD *)(v2 + 72) = 0i64;
*(_QWORD *)(v2 + 80) = 0i64;
*(_QWORD *)(v2 + 88) = 0i64;
*(_QWORD *)(v2 + 96) = 0i64;
*(_QWORD *)(v2 + 104) = 0i64;
*(_QWORD *)(v2 + 112) = 0i64;
}
else
{
v2 = 0i64;
}
*v1 = v2;
return v2;
}
// 180244B90: using guessed type int __fastcall RtlAllocateHeap(_QWORD, _QWORD, _QWORD);
// 18024A860: using guessed type __int64 (__fastcall *Windows::Rtl::CRtlObjectBase<MicrodomImplementation::CMicrodom>::`vftable'[14])();
// 18027CFF0: using guessed type __int64 (__fastcall *Windows::Rtl::SystemImplementation::CSystemIsolationLayer::`vftable'[5])();