How to speed up finding a function from pseudocode in IDA?

Question

I have a function with the pseudocode of

__int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3)
{
  if ( qword_7FF709F91498 )
    return (*(__int64 (__fastcall **)(ID2D1Geometry *, __int64, __int64, _QWORD))(*(_QWORD *)qword_7FF709F91498 + 24i64))(
             qword_7FF709F91498,
             a1,
             a2,
             a3);
  else
    return sub_7FF7067A0450(a1);
}

Considering there don't appear to be any strings I could easily search for , would there been any other possible way to speed up the process of finding this in IDA without going through lots of functions (for example , anything IDA could search for or anything that could be quickly identified?

Any assistance would be greatly appreciated. Thank you.

Answer 1

There's little in that function that could serve as a signature. The function itself consists of a single if-else statement with a direct and indirect call. The direct call could possibly be inlined in different compilations, as could the function itself (unless it's only ever called via function pointer).

The most distinguishing characteristic of this function is that it checks a global QWORD against NULL, and invokes its virtual function at +0x18 (passing through arguments #0-#2 as arguments #1-3 to the indirect call). That's a reasonable pattern, but also not so easy to find using IDA's standard search interfaces (though perhaps easier to find with a Hex-Rays plugin), and moreover, is likely to have false positives if the program uses a similar pattern to implement other functionality.

I'd say the best things to look at would be:

1. sub_7FF7067A0450. Does it have any better characteristics, such as: is it called within a few functions of a named export; does it have any unique strings, API calls, code sequences, etc., or do any of its nearby called/calling functions have any of those things?
2. Callers of sub_7FF7067A01F0 (same questions as above).
3. Look for other references to qword_7FF709F91498. Presumably this pointer starts as NULL, and at least one location writes a non-NULL value to it. Is there anything unique about the location(s) that write to it? If so, you can find the write to qword_7FF709F91498, and then use cross-references to find the function in your question. I'd start with the writes before moving on to other locations that read from qword_7FF709F91498, though either could work.
4. Since this is a global variable, maybe it's statically initialized by the runtime system prior to main? That could give you an easy way to find the constructor of this object, at which point, cross-references could help.