VfThunkApplyThunks
__int64 __fastcall VfThunkApplyThunks(__int64 a1, int a2){
unsigned int v4;
void *i;
INT64 v6;
int v7;
void *v8;
void *v9;
KAPC_STATE ApcState;
memset(&ApcState, 0, sizeof(ApcState));
if( !a2 || !(unsigned int)MmIsSessionAddress(*(PVOID *)(a1 + 48)) )
return ViThunkApplyThunksCurrentSession(a1, a2);
v4 = 1;
for( i = 0i64; ; i = v9 )
{
LODWORD(v8) = MmGetNextSession(i);
v9 = v8;
if( !v8 )
break;
if( MmAttachSession(v8, &ApcState) >= 0 )
{
v4 = 1;
MmIsDriverLoadedCurrentSession(*(_OWORD **)(a1 + 48), v6);
if( v7 )
v4 = ViThunkApplyThunksCurrentSession(a1, a2);
MmDetachSession(v9, &ApcState);
if( !v4 )
{
MmQuitNextSession(v9);
return v4;
}
}
}
return v4;
}Referenced by:
VfSuspectDriversLoadCallback