VfThunkAddSpecialDriverThunks

NTSTATUS __stdcall VfThunkAddSpecialDriverThunks(
        UINT64 EntryRoutine,
        PVOID ThunkBuffer,
        UINT64 ThunkBufferSize,
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  _DRIVER_SPECIFIED_VERIFIER_THUNKS *ThunkTable; 
  _DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS *NextSpecialTable; 
  VOID **PoolWithTag; 
  _QWORD *v10; 
  _QWORD *v11; 
  _DRIVER_SPECIFIED_VERIFIER_THUNKS **v12; 
  _DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS *v13; 
  int v14[10]; 
  UINT64 ImportThunk; 

  ImportThunk = EntryRoutine;
  ThunkTable = ViThunkCreateThunkTable(ThunkBuffer, (unsigned int)ThunkBufferSize, DataTableEntry);
  if( !ThunkTable )
    return -1073741670;
  VfDriverLock();
  if( (DataTableEntry->Flags & 0x2000000) != 0 )
    ViThunkRecoverPristines(ThunkTable);
  NextSpecialTable = ViThunkFindNextSpecialTable(&ImportThunk, 1ui64, 0i64);
  if( !NextSpecialTable )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1951821133i64);
    NextSpecialTable = (_DRIVER_SPECIFIED_SPECIAL_VERIFIER_THUNKS *)PoolWithTag;
    if( !PoolWithTag )
    {
      ViDriversLoadLockOwner = 0i64;
      KeReleaseMutex(&ViDriversLoadLock, 0);
      return -1073741670;
    }
    PoolWithTag[2] = (VOID *)EntryRoutine;
    v10 = PoolWithTag + 3;
    v10[1] = v10;
    *v10 = v10;
    v11 = ViVerifierDriverAddedSpecialThunkListHead;
    if( *((PVOID **)ViVerifierDriverAddedSpecialThunkListHead + 1) != &ViVerifierDriverAddedSpecialThunkListHead )
LABEL_11:
      __fastfail(3u);
    ++ViVerifierSpecialThunkTables;
    *(_QWORD *)NextSpecialTable = ViVerifierDriverAddedSpecialThunkListHead;
    *((_QWORD *)NextSpecialTable + 1) = &ViVerifierDriverAddedSpecialThunkListHead;
    v11[1] = NextSpecialTable;
    ViVerifierDriverAddedSpecialThunkListHead = NextSpecialTable;
  }
  VfThunksExtended = 1;
  _InterlockedOr(v14, 0);
  v12 = (_DRIVER_SPECIFIED_VERIFIER_THUNKS **)*((_QWORD *)NextSpecialTable + 4);
  v13 = NextSpecialTable + 6;
  ++ViActiveVerifierThunks;
  if( *v12 != v13 )
    goto LABEL_11;
  *(_QWORD *)ThunkTable = v13;
  *((_QWORD *)ThunkTable + 1) = v12;
  *v12 = ThunkTable;
  *((_QWORD *)v13 + 1) = ThunkTable;
  ViDriversLoadLockOwner = 0i64;
  KeReleaseMutex(&ViDriversLoadLock, 0);
  return 0;
}

Referenced by: