Add workflow for identifying TerminateProcess(GetCurrentProcess)

1 files changed, 10 insertions, 0 deletions

diff --git a/view/pe/peview.cpp b/view/pe/peview.cpp
index 8c2f3020..98cef6ed 100644
--- a/view/pe/peview.cpp
+++ b/view/pe/peview.cpp
@@ -2782,6 +2782,16 @@ bool PEView::Init()
 		m_logger->LogWarn("Failed to parse resource directory: %s\n", e.what());
 	}
 
+	Ref<Settings> programSettings = Settings::Instance();
+	if (programSettings->Contains("core.function.analyzeConditionalNoReturns") &&
+		opt.subsystem != IMAGE_SUBSYSTEM_NATIVE && (
+			GetSymbolByRawName("TerminateProcess", GetExternalNameSpace()) ||
+			GetSymbolByRawName("_TerminateProcess@8", GetExternalNameSpace())))
+	{
+		// TerminateProcess is imported and this is a user mode file
+		programSettings->Set("corePlugins.workflows.conditionalNoReturn", true);
+	}
+
 	// Add a symbol for the entry point
 	if (m_entryPoint)
 		DefineAutoSymbol(new Symbol(FunctionSymbol, "_start", m_imageBase + m_entryPoint));