ViThunkReplaceAllThunkedImports

UINT64 __stdcall ViThunkReplaceAllThunkedImports(
        UINT64 *ImportAddress,
        UINT64 ImportCount,
        UINT64 AlreadyRunning,
        UINT64 DriverIsSuspect){
  __int64 v4; 
  int v5; 
  int v6; 
  UINT64 *v7; 
  _DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS **AllSpecialTables; 
  __int64 v9; 
  _DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS *v10; 
  int v11; 
  UINT64 v12; 

  v4 = (unsigned int)ImportCount;
  v5 = DriverIsSuspect;
  v6 = AlreadyRunning;
  v7 = ImportAddress;
  if( (_DWORD)AlreadyRunning || (_DWORD)DriverIsSuspect != 1 )
    AllSpecialTables = 0i64;
  else
    AllSpecialTables = ViThunkFindAllSpecialTables(ImportAddress, (unsigned int)ImportCount);
  if( (_DWORD)v4 )
  {
    v9 = v4;
    do
    {
      if( AllSpecialTables )
      {
        v10 = *AllSpecialTables;
        v11 = 0;
        while( v10 )
        {
          if( (unsigned int)ViThunkReplaceImportEntry((_LIST_ENTRY *)(v10 + 6), v7) == 1 )
            goto LABEL_20;
          v10 = AllSpecialTables[++v11];
        }
      }
      if( ((_DWORD)KernelVerifier
         || !(unsigned int)ViThunkReplaceImportIfThunkedRegular((ULONG_PTR)v7, &VfRegularThunks)
         && !(unsigned int)ViThunkReplaceImportIfThunkedOrderDependent(v7, v12)
         && !(unsigned int)ViThunkReplaceImportIfThunkedRegular((ULONG_PTR)v7, &VfXdvThunks))
        && !(unsigned int)ViThunkReplaceImportIfThunkedRegular((ULONG_PTR)v7, &VfPoolThunks)
        && !v6
        && v5 == 1 )
      {
        ViThunkReplaceImportEntry(&ViVerifierDriverAddedThunkListHead, v7);
      }
LABEL_20:
      ++v7;
      --v9;
    }
    while( v9 );
  }
  if( AllSpecialTables )
    ExFreePoolWithTag(AllSpecialTables, 0);
  return 1i64;
}

Referenced by: