MiHotPatchAllProcesses

NTSTATUS __stdcall MiHotPatchAllProcesses(INT64 a1, INT64 a2){
  unsigned int v2; 
  unsigned int v3; 
  _EPROCESS *i; 
  int Blink_high; 
  _LIST_ENTRY *NextProcess; 
  _EX_RUNDOWN_REF *v7; 
  _KAPC_STATE ApcState; 

  v2 = a1;
  memset(&ApcState, 0, sizeof(ApcState));
  v3 = a2;
  for( i = 0i64; ; i = (_EPROCESS *)v7 )
  {
    NextProcess = PsGetNextProcess(i);
    v7 = (_EX_RUNDOWN_REF *)NextProcess;
    if( !NextProcess )
      break;
    Blink_high = HIDWORD(NextProcess[135].Blink);
    if( (Blink_high & 0x1000) == 0 && v7 != PsSecureSystemProcess && (Blink_high & 1) == 0 && !v7[280].Count )
    {
      KiStackAttachProcess(v7, 0i64, &ApcState);
      MiHotPatchProcess(v7, v2, v3);
      KiUnstackDetachProcess(&ApcState, 0i64);
    }
  }
  return 0;
}

Referenced by: