ViThunkApplyMandatoryThunksCurrentSession
UINT64 __stdcall ViThunkApplyMandatoryThunksCurrentSession(
_KLDR_DATA_TABLE_ENTRY *DataTableEntry,
UINT64 AlreadyRunning){
void *DllBase;
int v3;
VOID *v4;
unsigned int v5;
unsigned int v6;
__int64 v7;
UINT64 Size;
DllBase = DataTableEntry->DllBase;
LODWORD(Size) = 0;
v3 = AlreadyRunning;
v4 = RtlImageDirectoryEntryToData(DllBase, 1u, 0xCu, &Size);
if( v4 )
{
v5 = Size;
if( (_DWORD)Size )
{
if( v3 )
{
_InterlockedExchange(&ViLookasideAlreadyLoadedDrivers, 1);
_InterlockedExchange(&ViResourcesAlreadyLoadedDrivers, 1);
v5 = Size;
}
v6 = v5 >> 3;
if( v6 )
{
v7 = v6;
do
{
ViThunkReplaceImportIfThunkedRegular((ULONG_PTR)v4, &VfMandatoryThunks);
LODWORD(v4) = (_DWORD)v4 + 8;
--v7;
}
while( v7 );
}
}
}
return 1i64;
}Referenced by:
VfThunkApplyMandatoryThunks