IopWriteDriverList

NTSTATUS __stdcall IopWriteDriverList(
        UINT64 BufferAddress,
        UINT8 AtBugCheck,
        UINT64 DriverListOffset,
        UINT64 StringPoolOffset){
  PVOID *v4; 
  UINT64 v5; 
  UINT8 *v6; 
  int v8; 
  unsigned int v9; 
  __int64 v10; 
  __int64 v11; 
  UINT64 v12; 
  v4 = (PVOID *)PsLoadedModuleList;
  v5 = BufferAddress + (unsigned int)DriverListOffset;
  v6 = (UINT8 *)(BufferAddress + (unsigned int)StringPoolOffset);
  v8 = BufferAddress;
  v9 = 0;
  while( 1 )
  {
    if( v4 == &PsLoadedModuleList )
      return 0;
    if( AtBugCheck == 1
      && (!KiIsAddressRangeValid((INT64)v4, 160i64)
       || !KiIsAddressRangeValid((INT64)v4[12], *((unsigned __int16 *)v4 + 44))) )
    {
      break;
    }
    v10 = *((unsigned __int16 *)v4 + 44) >> 1;
    *(_DWORD *)v6 = v10;
    memmove(v6 + 4, (UINT8 *)v4[12], 2 * v10);
    *(_WORD *)&v6[2 * *(unsigned int *)v6 + 4] = 0;
    v11 = v9++;
    v12 = v5 + 144 * v11;
    *(_OWORD *)(v12 + 8) = *(_OWORD *)v4;
    *(_OWORD *)(v12 + 24) = *((_OWORD *)v4 + 1);
    *(_OWORD *)(v12 + 40) = *((_OWORD *)v4 + 2);
    *(_OWORD *)(v12 + 56) = *((_OWORD *)v4 + 3);
    *(_OWORD *)(v12 + 72) = *((_OWORD *)v4 + 4);
    *(_OWORD *)(v12 + 88) = *((_OWORD *)v4 + 5);
    *(_OWORD *)(v12 + 104) = *((_OWORD *)v4 + 6);
    *(_OWORD *)(v12 + 120) = *((_OWORD *)v4 + 7);
    *(_QWORD *)(v12 + 136) = v4[16];
    *(_DWORD *)(v12 + 136) = *((_DWORD *)v4 + 39);
    *(_DWORD *)(v12 + 72) = *((_DWORD *)v4 + 38);
    *(_DWORD *)v12 = (_DWORD)v6 - v8;
    v4 = (PVOID *)*v4;
    v6 = (UINT8 *)((unsigned __int64)&v6[2 * (*(_DWORD *)v6 + 1) + 11] & 0xFFFFFFFFFFFFFFF8ui64);
  }
  return -1073741823;
}

Referenced by: