MmAddVerifierThunks

NTSTATUS __stdcall MmAddVerifierThunks(VOID *ThunkBuffer, UINT64 ThunkBufferSize){
  unsigned int v2; 
  INT8 v4; 
  INT64 v5; 
  int v6; 
  _QWORD *v7; 
  unsigned int v8; 
  _ETHREAD *Lock; 
  _LIST_ENTRY *v11; 
  _KLDR_DATA_TABLE_ENTRY *v12; 
  _LIST_ENTRY *Flink; 
  int v14; 
  INT64 *v15; 
  char *v16; 
  unsigned __int64 v17; 
  NTSTATUS v18; 

  v2 = ThunkBufferSize;
  if( (MiFlags & 1) == 0 )
    return -1073741637;
  v6 = 0;
  if( !VfIsVerifierEnabled()
    || (*(&stru_140CF2E80 + 1826) & 0xFFAFFFFF) == 0
    && (*(&stru_140CF2E80 + 7308) & 2) == 0
    && (*(&stru_140CF2E80 + 7308) & 4) == 0 )
  {
    return -1073741637;
  }
  v7 = ThunkBuffer;
  v8 = v2 >> 4;
  if( !(v2 >> 4) )
    return -1073741585;
  Lock = MmAcquireLoadLock(v5, v4);
  v11 = MiLookupDataTableEntry(*(VOID **)ThunkBuffer, 0i64);
  v12 = (_KLDR_DATA_TABLE_ENTRY *)v11;
  if( v11 )
  {
    Flink = v11[3].Flink;
    v14 = 0;
    v15 = (INT64 *)PsLoadedModuleList;
    v16 = (char *)Flink + LODWORD(v11[4].Flink);
    while( v15 != &PsLoadedModuleList )
    {
      if( v11 == (_LIST_ENTRY *)v15 )
        goto LABEL_21;
      if( (unsigned int)++v14 >= 2 )
        break;
      v15 = (INT64 *)*v15;
    }
    if( !v8 )
    {
LABEL_20:
      v18 = VfThunkAddDriverThunks(ThunkBuffer, v2, v12);
      MmReleaseLoadLock(Lock);
      return v18;
    }
    while( *v7 >= (unsigned __int64)Flink )
    {
      if( *v7 >= (unsigned __int64)v16 )
        break;
      v17 = v7[1];
      if( v17 < (unsigned __int64)Flink || v17 >= (unsigned __int64)v16 )
        break;
      v7 += 2;
      if( ++v6 >= v8 )
        goto LABEL_20;
    }
  }
LABEL_21:
  MmReleaseLoadLock(Lock);
  return -1073741584;
}

Referenced by: