MmAddVerifierSpecialThunks

NTSTATUS __fastcall MmAddVerifierSpecialThunks(UINT64 a1, INT8 *a2, UINT64 a3){
  unsigned int v3; 
  INT8 v6; 
  INT64 v7; 
  int v8; 
  unsigned int v9; 
  _ETHREAD *Lock; 
  _LIST_ENTRY *v12; 
  _KLDR_DATA_TABLE_ENTRY *v13; 
  unsigned __int64 Flink; 
  unsigned __int64 v15; 
  INT8 *v16; 
  NTSTATUS v17; 
  unsigned __int64 retaddr; 

  v3 = a3;
  if( (MiFlags & 1) == 0 )
    return -1073741637;
  v8 = 0;
  if( !VfIsVerifierEnabled()
    || (*(&stru_140CF2E80 + 1826) & 0xFFAFFFFF) == 0
    && (*(&stru_140CF2E80 + 7308) & 2) == 0
    && (*(&stru_140CF2E80 + 7308) & 4) == 0 )
  {
    return -1073741637;
  }
  v9 = v3 >> 4;
  if( !(v3 >> 4) )
    return -1073741583;
  Lock = MmAcquireLoadLock(v7, v6);
  v12 = MiLookupDataTableEntry((VOID *)a1, 0i64);
  v13 = (_KLDR_DATA_TABLE_ENTRY *)v12;
  if( v12
    && (Flink = (unsigned __int64)v12[3].Flink, retaddr >= Flink)
    && (v15 = Flink + LODWORD(v12[4].Flink), retaddr < v15) )
  {
    if( v9 )
    {
      v16 = a2 + 8;
      while( *(_QWORD *)v16 >= Flink && *(_QWORD *)v16 < v15 )
      {
        v16 += 16;
        if( ++v8 >= v9 )
          goto LABEL_16;
      }
      v17 = -1073741584;
    }
    else
    {
LABEL_16:
      v17 = VfThunkAddSpecialDriverThunks(a1, a2, v3, v13);
    }
  }
  else
  {
    v17 = -1073741585;
  }
  MmReleaseLoadLock(Lock);
  return v17;
}

Referenced by: