ViFaultsAddAppNoDuplicates

NTSTATUS __stdcall ViFaultsAddAppNoDuplicates(PWCHAR ImageName, UINT64 NameLength){
  UINT64 v2; 
  NTSTATUS v4; 
  VOID *PoolWithTag; 
  _UNICODE_STRING *v6; 
  WCHAR v7; 
  UINT64 v8; 
  unsigned __int8 v9; 
  unsigned __int64 v10; 
  _UNICODE_STRING **v11; 
  v2 = 2 * NameLength;
  v4 = 0;
  PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 2 * NameLength + 34, 0x41466656ui64);
  v6 = (_UNICODE_STRING *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove((UINT8 *)PoolWithTag + 32, (UINT8 *)ImageName, v2);
  *(unsigned __int16 *)((char *)&v6[2].Length + v2) = 0;
  RtlInitUnicodeString(v6 + 1, &v6[2].Length, v7);
  RtlUpcaseUnicodeString(v6 + 1, v6 + 1, 0);
  KeAcquireSpinLockRaiseToDpc(&ViFaultInjectionLock, v8);
  v10 = v9;
  if( (unsigned int)ViFaultsIsAppTarget(v6 + 1) )
  {
    ExFreePoolWithTag(v6, 0);
  }
  else
  {
    v11 = (_UNICODE_STRING **)qword_140C1C9A8;
    if( *(PVOID **)qword_140C1C9A8 != &ViFaultApplicationsList )
      __fastfail(3u);
    *(_QWORD *)&v6->Length = &ViFaultApplicationsList;
    v6->Buffer = (wchar_t *)v11;
    *v11 = v6;
    qword_140C1C9A8 = (__int64)v6;
  }
  KxReleaseSpinLock(&ViFaultInjectionLock);
  __writecr8(v10);
  return v4;
}

Referenced by: