PsMapSystemDlls
__int64 __fastcall PsMapSystemDlls(ULONG_PTR a1, int a2){
int v4;
int v5;
int v6;
__int64 *v7;
__int64 v8;
_KAPC_STATE ApcState;
memset(&ApcState, 0, sizeof(ApcState));
v4 = 0;
if( a1 == *((_QWORD *)KeGetCurrentThread() + 23) )
{
v5 = 0;
}
else
{
v5 = 1;
KiStackAttachProcess((_KPROCESS *)a1, 0i64, &ApcState);
}
v6 = 0;
v7 = (__int64 *)&PspSystemDlls;
while( 1 )
{
v8 = *v7;
if( *v7
&& (v6 <= 0 || *(_WORD *)(v8 + 18) && *(_QWORD *)(a1 + 1408) && v6 == (unsigned int)PsWow64GetProcessNtdllType(a1)) )
{
v4 = PspMapSystemDll((_EPROCESS *)a1, v8, a2, 0);
if( v4 < 0 )
break;
}
++v6;
++v7;
if( v6 >= 6 )
goto LABEL_9;
}
if( v6 > 0 )
v4 = -1073741405;
LABEL_9:
if( v5 )
KiUnstackDetachProcess(&ApcState, 0i64);
return(unsigned int)v4;
}Referenced by:
MiMapProcessExecutable