Function UnloadFile_Thread

NoEye_Service/CMap.cpp:758–799

		return Status;
	};
	DWORD WINAPI UnloadFile_Thread(WDLL* wDll)
	{
		PIMAGE_EXPORT_DIRECTORY Exports = 0;
		PIMAGE_TLS_CALLBACK* TlsCallBack;
		DWORD Oridinal = 0, Status = 0;
		if (wDll->NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress &&
			wDll->NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size &&
			(wDll->Flags & ManualMap_FLAGS::CALL_EXPORT))
		{
			Exports = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>(reinterpret_cast<DWORD_PTR>(wDll->Image) + wDll->NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
			Oridinal = 0;
			if (Oridinal > Exports->NumberOfFunctions)
				return FALSE;
			wDll->Entrypoint = reinterpret_cast<FARPROC>((reinterpret_cast<DWORD*>((Exports->AddressOfFunctions + reinterpret_cast<DWORD_PTR>(wDll->Image)))[Oridinal] + reinterpret_cast<DWORD_PTR>(wDll->Image)));
			if (wDll->Entrypoint)
			{
				Status = reinterpret_cast<BOOL(WINAPI*)(DWORD_PTR, DWORD, LPVOID)>(wDll->Entrypoint)(reinterpret_cast<DWORD_PTR>(wDll->Image), DLL_PROCESS_DETACH, NULL);
			}
		}
		if (wDll->Tls &&
			wDll->NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size)
		{
			TlsCallBack = reinterpret_cast<PIMAGE_TLS_CALLBACK*>(wDll->Tls->AddressOfCallBacks);
			if (TlsCallBack)
			{
				while (*TlsCallBack)
				{
					Status = reinterpret_cast<BOOL(WINAPI*)(DWORD_PTR, DWORD, LPVOID)>(*TlsCallBack)(reinterpret_cast<DWORD_PTR>(wDll->Image), DLL_PROCESS_DETACH, NULL);
					TlsCallBack++;
				}
			}
		}

		wDll->Entrypoint = reinterpret_cast<PVOID>((reinterpret_cast<DWORD_PTR>(wDll->Image) + wDll->NtHeader->OptionalHeader.AddressOfEntryPoint));
		if (wDll->NtHeader->OptionalHeader.AddressOfEntryPoint && !(wDll->Flags & ManualMap_FLAGS::CALL_EXPORT))
		{
			if ((wDll->NtHeader->FileHeader.Characteristics & IMAGE_FILE_DLL) == IMAGE_FILE_DLL)
				Status = reinterpret_cast<BOOL(WINAPI*)(DWORD_PTR, DWORD, LPVOID)>(wDll->Entrypoint)(reinterpret_cast<DWORD_PTR>(wDll->Image), DLL_PROCESS_DETACH, NULL);
		}
		return Status;

	}
}