ViFaultsAddAppNoDuplicates

NTSTATUS __stdcall ViFaultsAddAppNoDuplicates(WCHAR *ImageName, UINT64 NameLength){
  UINT64 v2; 
  NTSTATUS v4; 
  VOID **PoolWithTag; 
  _UNICODE_STRING *v6; 
  unsigned __int64 v7; 
  _UNICODE_STRING **v8; 

  v2 = 2 * NameLength;
  v4 = 0;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 2 * NameLength + 34, 1095132758i64);
  v6 = (_UNICODE_STRING *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove(PoolWithTag + 4, ImageName, v2);
  *(unsigned __int16 *)((char *)&v6[2].Length + v2) = 0;
  RtlInitUnicodeString(v6 + 1, &v6[2].Length);
  RtlUpcaseUnicodeString(v6 + 1, v6 + 1, 0);
  v7 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&ViFaultInjectionLock);
  if( (unsigned int)ViFaultsIsAppTarget(v6 + 1) )
  {
    ExFreePoolWithTag(v6, 0);
  }
  else
  {
    v8 = (_UNICODE_STRING **)qword_140C1C9A8;
    if( *(PVOID **)qword_140C1C9A8 != &ViFaultApplicationsList )
      __fastfail(3u);
    *(_QWORD *)&v6->Length = &ViFaultApplicationsList;
    v6->Buffer = (wchar_t *)v8;
    *v8 = v6;
    qword_140C1C9A8 = (__int64)v6;
  }
  KxReleaseSpinLock(&ViFaultInjectionLock);
  __writecr8(v7);
  return v4;
}

Referenced by: