MmVerifyCallbackFunctionCheckFlags
UINT64 __stdcall MmVerifyCallbackFunctionCheckFlags(PVOID Function){
int v1;
int v2;
BOOL v4;
_ETHREAD *CurrentThread;
unsigned int v6;
INT64 v7;
__int64 v8;
v2 = v1;
if( (unsigned int)MiGetSystemRegionType((UINT64)Function) == 1 )
return 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v6 = 0;
--*((_WORD *)CurrentThread + 242);
LOBYTE(v4) = 1;
ExAcquireResourceSharedLite(&PsLoadedModuleResource, v4);
v8 = MiLookupDataTableEntry((unsigned __int64)Function, 0i64, v7);
if( v8 && (!v2 || (*(_DWORD *)(v8 + 104) & v2) != 0) )
v6 = 1;
ExReleaseResourceLite(&PsLoadedModuleResource);
KeLeaveCriticalRegionThread((__int64)CurrentThread);
return v6;
}Referenced by:
MmVerifyCallbackFunction
ObRegisterCallbacks
PsSetCreateThreadNotifyRoutineEx
PspSetCreateProcessNotifyRoutine