IsParamOfFunc returns true if the CONTEXT structure is supplied as a single parameter to the well-known API functions.
(f string)
| 100 | // structure is supplied as a single parameter |
| 101 | // to the well-known API functions. |
| 102 | func IsParamOfFunc(f string) bool { |
| 103 | return f == "NtContinue" || f == "ZwContinue" || f == "RtlCaptureContext" |
| 104 | } |
no outgoing calls