ViThunkAdjustExportAddressIfHooked

UINT64 __stdcall ViThunkAdjustExportAddressIfHooked(
        VOID **ExportAddress,
        _UNICODE_STRING *SystemRoutineName,
        _VERIFIER_THUNKS *Thunks,
        UINT64 ThunkSize){
  char *Buffer; 
  unsigned int v6; 
  int v7; 
  VOID *v11; 
  unsigned __int8 *v12; 
  int v13; 
  int v14; 
  _STRING DestinationString; 

  *(_QWORD *)&DestinationString.Length = 0i64;
  Buffer = 0i64;
  v6 = 0;
  v7 = 0;
  DestinationString.Buffer = 0i64;
  if( *(_QWORD *)Thunks )
  {
    while( 1 )
    {
      v11 = (VOID *)*((_QWORD *)Thunks + 2);
      if( v11 == *ExportAddress )
        break;
      if( !v11 )
      {
        if( !v7 )
        {
          while( RtlUnicodeStringToAnsiString(&DestinationString, SystemRoutineName, 1u) < 0 )
            KeDelayExecutionThread(0, 0, (_LARGE_INTEGER *)&ViShortTime);
          Buffer = DestinationString.Buffer;
          v7 = 1;
        }
        v12 = *(unsigned __int8 **)Thunks;
        do
        {
          v13 = (unsigned __int8)Buffer[(_QWORD)v12 - *(_QWORD *)Thunks];
          v14 = *v12 - v13;
          if( v14 )
            break;
          ++v12;
        }
        while( v13 );
        if( !v14 )
          break;
      }
      Thunks = (_VERIFIER_THUNKS *)((char *)Thunks + ThunkSize);
      if( !*(_QWORD *)Thunks )
        goto LABEL_16;
    }
    v6 = 1;
    *ExportAddress = (VOID *)*((_QWORD *)Thunks + 1);
LABEL_16:
    if( v7 )
      RtlFreeAnsiString((_UNICODE_STRING *)&DestinationString);
  }
  return v6;
}

Referenced by: