MmVerifyCallbackFunctionCheckFlags
NTSTATUS __stdcall MmVerifyCallbackFunctionCheckFlags(VOID *Function){
int v1;
int v2;
_ETHREAD *CurrentThread;
NTSTATUS v5;
_LIST_ENTRY *v6;
v2 = v1;
if( MiGetSystemRegionType((UINT64)Function) == 1 )
return 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v5 = 0;
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
v6 = MiLookupDataTableEntry(Function, 0i64);
if( v6 && (!v2 || ((__int64)v6[6].Blink & v2) != 0) )
v5 = 1;
ExReleaseResourceLite(&PsLoadedModuleResource);
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
return v5;
}Referenced by:
MmVerifyCallbackFunction
ObRegisterCallbacks
PsSetCreateThreadNotifyRoutineEx
PspSetCreateProcessNotifyRoutine