CFreeMarshaler::MarshalInterface逆向结果唯一可以触发CFreeMarshaler::InitSecret的地方

HRESULT __stdcall CFreeMarshaler::MarshalInterface(CFreeMarshaler *this, IStream *pStm, _GUID *riid, void *pv, unsigned int dwDestContext, void *pvDestContext, unsigned int mshlflags)
{
  int v7; // edi
  HRESULT result; // eax
  unsigned int v9; // eax
  unsigned int v10; // ST18_4
  void *v11; // ST14_4
  unsigned int v12; // ST10_4
  CObjectContext *v13; // eax
  __int64 v14; // [esp+10h] [ebp-24h] OVERLAPPED
  HRESULT hr; // [esp+18h] [ebp-1Ch]
  CPPEH_RECORD ms_exc; // [esp+1Ch] [ebp-18h]
  int fUseCurrentApartment; // [esp+3Ch] [ebp+8h]

  hr = 0;
  if ( dwDestContext == 3 || dwDestContext == 4 )
  {
    dwDestContext = 0;
    v7 = (**(int (__stdcall ***)(void *, _GUID *, unsigned int *))pv)(pv, riid, &dwDestContext);
    if ( v7 >= 0 )
    {
      v7 = pStm->_SelfStreamVtbl->Write(pStm, &mshlflags, 4u, 0);
      if ( v7 )
        goto LABEL_25;
      v14 = (signed int)dwDestContext;
      v7 = pStm->_SelfStreamVtbl->Write(pStm, &v14, 8u, 0);
      if ( v7 < 0 )
        goto LABEL_25;
      if ( !CFreeMarshaler::_fSecretInit )
        v7 = CFreeMarshaler::InitSecret(this);
      if ( v7 < 0
        || (v7 = pStm->_SelfStreamVtbl->Write(pStm, CFreeMarshaler::_SecretBlock, 16u, 0)) != 0
        || mshlflags == 2 )
      {
LABEL_25:
        (*(void (__stdcall **)(unsigned int))(*(_DWORD *)dwDestContext + 8))(dwDestContext);
      }
    }
    result = v7;
  }
  else
  {
    fUseCurrentApartment = UseFTMFromCurrentApartment();
    HIDWORD(v14) = 0;
    if ( !fUseCurrentApartment )
      HIDWORD(v14) = EnterNTA(g_pNTAEmptyCtx);
    ms_exc.registration.TryLevel = 0;
    hr = InitChannelIfNecessary();
    if ( hr >= 0 )
    {
      v9 = mshlflags;
      if ( !fUseCurrentApartment )
        v9 = mshlflags | 0x40000;
      v10 = v9;
      v11 = pvDestContext;
      v12 = dwDestContext;
      v13 = GetEmptyContext();
      hr = StdMarshalObject(pStm, riid, (IUnknown *)pv, v13, v12, v11, v10);
    }
    ms_exc.registration.TryLevel = -2;
    if ( !fUseCurrentApartment )
      LeaveNTA((CObjectContext *)HIDWORD(v14));
    result = hr;
  }
  return result;
}

看看会不会触发CFreeMarshaler::InitSecret,windbg接着看https://googleprojectzero.blogspot.kr/2014/12/