ViThunkSnapSharedExportByName

__int64 __fastcall ViThunkSnapSharedExportByName(char *a1, __int64 a2, __int64 a3, __int64 a4){
  unsigned int v4; 
  unsigned int *v8; 
  unsigned int *v9; 
  const char *v10; 
  __int64 *v12; 
  char *v13; 
  char v14; 
  INT8 *v15; 
  int v16; 
  UINT64 Size; 
  __int64 v18; 

  v4 = 0;
  *(_QWORD *)a4 = 0i64;
  *(_QWORD *)(a4 + 8) = 0i64;
  v8 = (unsigned int *)RtlImageDirectoryEntryToData(a1, 1u, 1u, &Size);
  v9 = v8;
  if( v8 && v8[3] )
  {
    do
    {
      if( !*v9 )
        break;
      v10 = &a1[v9[3]];
      if( !stricmp(v10, "ntoskrnl.exe") || !stricmp(v10, "hal.dll") )
      {
        v12 = (__int64 *)&a1[*v9];
        v13 = &a1[v9[4]];
        while( *v12 )
        {
          if( *v12 >= 0 && !stricmp(&a1[*v12 + 2], *(const char **)a2) )
          {
            *(_QWORD *)a4 = v13;
            *(_QWORD *)(a4 + 8) = *(_QWORD *)(a2 + 8);
            v14 = *(&stru_140CF2E80 + 7308);
            if( (*(&stru_140CF2E80 + 7308) & 8) == 0
              || VfIsVerifierEnabled()
              && ((*(&stru_140CF2E80 + 1826) & 0xFFAFFFFF) != 0 || (v14 & 2) != 0 || (v14 & 4) != 0) )
            {
              *(_DWORD *)(a4 + 24) |= 1u;
            }
            else if( XdvEnabled )
            {
              if( VfDifAPIThunkContextHead )
              {
                *(_QWORD *)(a4 + 16) = *(_QWORD *)(a2 + 32);
                v15 = *(INT8 **)a2;
                v18 = 0i64;
                ViThunkFindAPIContextByName(v15);
                if( v18 )
                {
                  v16 = *(_DWORD *)(a4 + 24) | 1;
                  *(_DWORD *)(a4 + 24) = v16;
                  if( (*(_DWORD *)(a2 + 24) & 4) != 0 )
                    *(_DWORD *)(a4 + 24) = v16 | 4;
                }
              }
            }
            return 1;
          }
          ++v12;
          v13 += 8;
        }
      }
      v9 += 5;
    }
    while( v9[3] );
  }
  return v4;
}

Referenced by: