ViThunkApplyMandatoryThunksCurrentSession
UINT64 __fastcall ViThunkApplyMandatoryThunksCurrentSession(
_KLDR_DATA_TABLE_ENTRY *DataTableEntry,
UINT64 AlreadyRunning){
void *v2;
int v3;
ULONG_PTR v4;
ULONG_PTR v5;
unsigned int v6;
unsigned int v7;
__int64 v8;
UINT64 Size;
v2 = (void *)*((_QWORD *)DataTableEntry + 6);
LODWORD(Size) = 0;
v3 = AlreadyRunning;
LODWORD(v4) = RtlImageDirectoryEntryToData(v2, 1u, 0xCu, &Size);
v5 = v4;
if( v4 )
{
v6 = Size;
if( (_DWORD)Size )
{
if( v3 )
{
_InterlockedExchange(&ViLookasideAlreadyLoadedDrivers, 1);
_InterlockedExchange(&ViResourcesAlreadyLoadedDrivers, 1);
v6 = Size;
}
v7 = v6 >> 3;
if( v7 )
{
v8 = v7;
do
{
ViThunkReplaceImportIfThunkedRegular(v5, &VfMandatoryThunks);
v5 += 8i64;
--v8;
}
while( v8 );
}
}
}
return 1i64;
}Referenced by:
VfThunkApplyMandatoryThunks