ViThunkReplacePristine

NTSTATUS __fastcall ViThunkReplacePristine(
        _VERIFIER_THUNKS *Thunk,
        UINT64 ThunkSize,
        UINT64 a3,
        INT64 **Pristine,
        VOID *a5){
  NTSTATUS result; 

  result = 0;
  if( *(_QWORD *)Thunk )
  {
    while( *(_QWORD *)a3 != *((_QWORD *)Thunk + 1) )
    {
      Thunk = (_VERIFIER_THUNKS *)((char *)Thunk + ThunkSize);
      if( !*(_QWORD *)Thunk )
        return result;
    }
    *(_QWORD *)a3 = *((_QWORD *)Thunk + 2);
    return 1;
  }
  return result;
}

Referenced by:

ViThunkRecoverPristines