MiUpdateThunks

VOID __stdcall MiUpdateThunks(
        _LOADER_PARAMETER_BLOCK *LoaderBlock,
        VOID *OldAddress,
        VOID *NewAddress,
        UINT64 NumberOfBytes){
  char *v4; 
  _LIST_ENTRY *p_LoadOrderListHead; 
  _LIST_ENTRY *Flink; 
  signed __int64 v7; 
  unsigned __int64 *v9; 
  __int64 v10; 
  unsigned __int64 v11; 
  UINT64 Size; 

  LODWORD(Size) = 0;
  v4 = (char *)OldAddress + (unsigned int)(NumberOfBytes - 1);
  p_LoadOrderListHead = &LoaderBlock->LoadOrderListHead;
  Flink = LoaderBlock->LoadOrderListHead.Flink;
  v7 = (_BYTE *)NewAddress - (_BYTE *)OldAddress;
  while( Flink != p_LoadOrderListHead )
  {
    v9 = (unsigned __int64 *)RtlImageDirectoryEntryToData(Flink[3].Flink, 1u, 0xCu, &Size);
    if( v9 )
    {
      LODWORD(Size) = (unsigned int)Size >> 3;
      v10 = (unsigned int)Size;
      if( (_DWORD)Size )
      {
        do
        {
          v11 = *v9;
          if( *v9 >= (unsigned __int64)OldAddress && v11 <= (unsigned __int64)v4 )
            *v9 = v7 + v11;
          ++v9;
          --v10;
        }
        while( v10 );
      }
    }
    Flink = Flink->Flink;
  }
}

Referenced by: