ViThunkApplyThunksCurrentSession
__int64 __fastcall ViThunkApplyThunksCurrentSession(__int64 a1, int a2){
void *v2;
unsigned int v5;
CHAR *Node;
INT64 *v7;
UINT64 *v8;
UINT64 *v9;
unsigned int v10;
unsigned int IsDriverSuspectForVerifier;
UINT64 Size;
v2 = *(void **)(a1 + 48);
LODWORD(Size) = 0;
v5 = 0;
Node = VfTargetDriversGetNode((UINT64)v2);
v7 = (INT64 *)Node;
if( Node )
{
if( (*((_DWORD *)Node + 6) & 1) == 0 )
{
LODWORD(v8) = RtlImageDirectoryEntryToData(v2, 1u, 0xCu, &Size);
v9 = v8;
if( v8 )
{
v10 = Size;
if( (_DWORD)Size )
{
if( a2 )
{
_InterlockedExchange(&ViLookasideAlreadyLoadedDrivers, 1);
_InterlockedExchange(&ViResourcesAlreadyLoadedDrivers, 1);
v10 = Size;
}
IsDriverSuspectForVerifier = ViIsDriverSuspectForVerifier((_KLDR_DATA_TABLE_ENTRY *)a1);
v5 = ViThunkReplaceAllThunkedImports(v9, v10 >> 3, (unsigned int)a2, IsDriverSuspectForVerifier);
if( v5 )
ViThunkReplaceAllSharedExports(v7, (unsigned int)a2);
}
}
}
}
return v5;
}Referenced by:
VfThunkApplyThunks