VfGetVerifierInformation

NTSTATUS __stdcall VfGetVerifierInformation(
        PVOID SystemInformation,
        UINT64 SystemInformationLength,
        UINT64 *ReturnedLength,
        UINT64 GetAdditionalCounters){
  int v4; 
  unsigned int v7; 
  unsigned __int64 v8; 
  VOID **PoolWithTag; 
  NTSTATUS VerifierInformation; 
  UINT64 GetAdditionalCountersa; 

  v4 = GetAdditionalCounters;
  *(_DWORD *)ReturnedLength = 0;
  v7 = 10485760;
  if( (unsigned int)SystemInformationLength <= 0xA00000 )
    v7 = SystemInformationLength;
  v8 = v7;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v7, 1886213206i64);
  if( !PoolWithTag )
    return -1073741801;
  memset(PoolWithTag, 0, v8);
  LODWORD(GetAdditionalCountersa) = v4;
  VerifierInformation = VfSuspectDriversGetVerifierInformation(
                          PoolWithTag,
                          (unsigned int)v8,
                          ReturnedLength,
                          SystemInformation,
                          GetAdditionalCountersa);
  if( *(_DWORD *)ReturnedLength <= (unsigned int)v8 )
    LODWORD(v8) = *(_DWORD *)ReturnedLength;
  memmove(SystemInformation, PoolWithTag, v8);
  ExFreePoolWithTag(PoolWithTag, 0);
  return VerifierInformation;
}

Referenced by: