MmAddVerifierSpecialThunks

NTSTATUS __stdcall MmAddVerifierSpecialThunks(ULONG_PTR EntryRoutine, PVOID ThunkBuffer, ULONG ThunkBufferSize){
  int v6; 
  ULONG v7; 
  _ETHREAD *Lock; 
  INT64 v10; 
  __int64 v11; 
  __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 *v15; 
  NTSTATUS v16; 
  unsigned __int64 retaddr; 
  if( (MiFlags & 1) == 0 )
    return -1073741637;
  v6 = 0;
  if( !(unsigned int)VfIsVerifierEnabled()
    || (VfRuleClasses & 0xFFAFFFFF) == 0
    && (VfRuleClasses & 0x200000000i64) == 0
    && (VfRuleClasses & 0x400000000i64) == 0 )
  {
    return -1073741637;
  }
  v7 = ThunkBufferSize >> 4;
  if( !(ThunkBufferSize >> 4) )
    return -1073741583;
  Lock = MmAcquireLoadLock();
  v11 = MiLookupDataTableEntry(EntryRoutine, 0i64, v10);
  v12 = v11;
  if( v11 && (v13 = *(_QWORD *)(v11 + 48), retaddr >= v13) && (v14 = v13 + *(unsigned int *)(v11 + 64), retaddr < v14) )
  {
    if( v7 )
    {
      v15 = (unsigned __int64 *)((char *)ThunkBuffer + 8);
      while( *v15 >= v13 && *v15 < v14 )
      {
        v15 += 2;
        if( ++v6 >= v7 )
          goto LABEL_16;
      }
      v16 = -1073741584;
    }
    else
    {
LABEL_16:
      v16 = VfThunkAddSpecialDriverThunks(EntryRoutine, ThunkBuffer, ThunkBufferSize, v12);
    }
  }
  else
  {
    v16 = -1073741585;
  }
  MmReleaseLoadLock(Lock);
  return v16;
}

Referenced by: