MmAddVerifierThunks

NTSTATUS __stdcall MmAddVerifierThunks(PVOID ThunkBuffer, ULONG ThunkBufferSize){
  int v4; 
  unsigned __int64 *v5; 
  ULONG v6; 
  _ETHREAD *Lock; 
  INT64 v9; 
  __int64 v10; 
  _KLDR_DATA_TABLE_ENTRY *v11; 
  unsigned __int64 v12; 
  int v13; 
  PVOID *v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  NTSTATUS v17; 
  if( (MiFlags & 1) == 0 )
    return -1073741637;
  v4 = 0;
  if( !(unsigned int)VfIsVerifierEnabled()
    || (VfRuleClasses & 0xFFAFFFFF) == 0
    && (VfRuleClasses & 0x200000000i64) == 0
    && (VfRuleClasses & 0x400000000i64) == 0 )
  {
    return -1073741637;
  }
  v5 = (unsigned __int64 *)ThunkBuffer;
  v6 = ThunkBufferSize >> 4;
  if( !(ThunkBufferSize >> 4) )
    return -1073741585;
  Lock = MmAcquireLoadLock();
  v10 = MiLookupDataTableEntry(*(_QWORD *)ThunkBuffer, 0i64, v9);
  v11 = (_KLDR_DATA_TABLE_ENTRY *)v10;
  if( v10 )
  {
    v12 = *(_QWORD *)(v10 + 48);
    v13 = 0;
    v14 = (PVOID *)PsLoadedModuleList;
    v15 = v12 + *(unsigned int *)(v10 + 64);
    while( v14 != &PsLoadedModuleList )
    {
      if( (PVOID *)v10 == v14 )
        goto LABEL_21;
      if( (unsigned int)++v13 >= 2 )
        break;
      v14 = (PVOID *)*v14;
    }
    if( !v6 )
    {
LABEL_20:
      v17 = VfThunkAddDriverThunks(ThunkBuffer, ThunkBufferSize, v11);
      MmReleaseLoadLock(Lock);
      return v17;
    }
    while( *v5 >= v12 )
    {
      if( *v5 >= v15 )
        break;
      v16 = v5[1];
      if( v16 < v12 || v16 >= v15 )
        break;
      v5 += 2;
      if( ++v4 >= v6 )
        goto LABEL_20;
    }
  }
LABEL_21:
  MmReleaseLoadLock(Lock);
  return -1073741584;
}

Referenced by: