ViThunkReplaceImportIfThunkedRegular

UINT64 __stdcall ViThunkReplaceImportIfThunkedRegular(ULONG_PTR ImportAddress, _VERIFIER_XDV_THUNKS *Thunks){
  UINT64 result; 
  unsigned int v3; 
  _VERIFIER_XDV_THUNKS *v4; 
  UINT64 *v5; 
  char v6; 
  _VERIFIER_XDV_THUNKS v7; 
  UINT64 v8; 

  result = **(_QWORD **)&ImportAddress;
  v3 = 0;
  v4 = Thunks;
  v5 = *(UINT64 **)&ImportAddress;
  if( **(_QWORD **)&ImportAddress )
  {
    if( !*(_QWORD *)Thunks )
      return v3;
    while( result != *((_QWORD *)v4 + 2) )
    {
      v4 += 12;
      if( !*(_QWORD *)v4 )
        return v3;
    }
    v6 = *(&stru_140CF2E80 + 7308);
    if( (*(&stru_140CF2E80 + 7308) & 8) == 0
      || VfIsVerifierEnabled() && ((*(&stru_140CF2E80 + 1826) & 0xFFAFFFFF) != 0 || (v6 & 2) != 0 || (v6 & 4) != 0) )
    {
      goto LABEL_17;
    }
    if( !XdvEnabled )
      return 1;
    if( !VfDifAPIThunkContextHead )
      return 1;
    v7 = v4[6];
    if( (v7 & 1) == 0 )
      return 1;
    if( (v7 & 4) != 0 )
    {
LABEL_17:
      v8 = *((_QWORD *)v4 + 1);
    }
    else
    {
      v8 = **((_QWORD **)v4 + 4);
      if( !v8 )
        return 1;
    }
    MmReplaceImportEntry(v5, v8);
    return 1;
  }
  return result;
}

Referenced by: