ViThunkReplaceSharedExports
void __fastcall ViThunkReplaceSharedExports(__int64 a1, unsigned int a2){
__int64 v2;
__int64 i;
UINT64 *v4;
int v5;
UINT64 v6;
if( a1 && a2 )
{
v2 = a1 + 8;
for( i = a2; i; --i )
{
v4 = *(UINT64 **)(v2 - 8);
if( v4 )
{
if( !VfIsRuleClassEnabled(0x23ui64)
|| (unsigned int)VfIsVerifierEnabled()
&& ((VfRuleClasses & 0xFFAFFFFF) != 0
|| (VfRuleClasses & 0x200000000i64) != 0
|| (VfRuleClasses & 0x400000000i64) != 0) )
{
goto LABEL_16;
}
if( !XdvEnabled )
goto LABEL_18;
if( !VfDifAPIThunkContextHead )
goto LABEL_18;
v5 = *(_DWORD *)(v2 + 16);
if( (v5 & 1) == 0 )
goto LABEL_18;
if( (v5 & 4) != 0 )
{
LABEL_16:
v6 = *(_QWORD *)v2;
LABEL_17:
MmReplaceImportEntry(v4, v6);
goto LABEL_18;
}
v6 = **(_QWORD **)(v2 + 8);
if( v6 )
goto LABEL_17;
}
LABEL_18:
v2 += 32i64;
}
}
}Referenced by:
ViThunkReplaceAllSharedExports