RtlCheckCurrentPatchesApplied
NTSTATUS __stdcall RtlCheckCurrentPatchesApplied(INT64 a1, INT64 a2, UINT64 *a3, UINT64 a4){
__int64 v4;
UINT64 *v5;
__int64 v8;
__int64 v9;
LODWORD(v4) = 0;
v5 = a3;
if( !(_DWORD)a4 )
return 1;
while( 1 )
{
v8 = *(unsigned int *)v5;
if( (_DWORD)v8 )
{
LODWORD(v9) = RtlpCheckFunctionPatchApplied((_BYTE *)(a1 + v8));
if( v9 != a2 + 8 * v4 )
break;
}
LODWORD(v4) = v4 + 1;
v5 = (UINT64 *)((char *)v5 + 6);
if( (unsigned int)v4 >= (unsigned int)a4 )
return 1;
}
return 0;
}Referenced by:
MiPrepareToHotPatchImage