VfSuspectDriversParseRegistryString

VOID __stdcall VfSuspectDriversParseRegistryString(){
  wchar_t *v0; 
  _BOOL4 v1; 
  __int64 *v2; 
  __int64 v3; 
  unsigned __int64 v4; 
  wchar_t *v5; 
  unsigned __int64 v6; 
  int v7; 
  _VF_SUSPECT_DRIVER_ENTRY *Entry; 
  VOID **v9; 
  VOID ***v10; 
  _UNICODE_STRING ImageFileName[2]; 

  v0 = (wchar_t *)MmVerifyDriverBuffer;
  ImageFileName[0] = 0i64;
  v1 = (VfOptionFlags & 1) == 0;
  v2 = (__int64 *)((char *)MmVerifyDriverBuffer
                 + 2 * (((unsigned __int64)(unsigned int)MmVerifyDriverBufferLength - 2) >> 1));
  if( MmVerifyDriverBuffer < v2 )
  {
    v3 = 0x100002601i64;
    while( 1 )
    {
      v4 = *v0;
      if( (unsigned int)v4 <= 0x20 && _bittest64(&v3, v4) || (_WORD)v4 == 12288 )
      {
        v5 = v0;
        goto LABEL_30;
      }
      if( (_DWORD)v4 == 42 && v1 )
      {
        LODWORD(ViVerifyAllDrivers) = 1;
        return;
      }
      v5 = v0 + 1;
      if( (_DWORD)v4 == 34 )
      {
        ++v0;
        if( ++v5 >= (wchar_t *)v2 )
          return;
        do
        {
          if( *v5 == 34 )
            break;
          ++v5;
        }
        while( v5 < (wchar_t *)v2 );
        if( v5 >= (wchar_t *)v2 )
          return;
      }
      else
      {
        while( v5 < (wchar_t *)v2 )
        {
          v6 = *v5;
          if( (unsigned int)v6 <= 0x20 )
          {
            if( _bittest64(&v3, v6) )
              break;
          }
          if( (_WORD)v6 == 12288 )
            break;
          ++v5;
        }
      }
      v7 = 2 * (v5 - v0);
      if( v7 )
        break;
LABEL_30:
      v0 = v5 + 1;
      if( v5 + 1 >= (wchar_t *)v2 )
        return;
    }
    ImageFileName[0].Length = 2 * (v5 - v0);
    ImageFileName[0].MaximumLength = v7 + 2;
    if( (unsigned __int16)(v7 + 2) < (unsigned __int16)v7 )
      return;
    ImageFileName[0].Buffer = v0;
    if( v1 )
    {
      Entry = VfSuspectDriversAllocateEntry(ImageFileName);
      if( Entry )
      {
        VfDriverLock();
        VfSuspectDriversInsert(Entry);
LABEL_27:
        VfDriverUnlock();
      }
    }
    else
    {
      v9 = VfSuspectExcludedDriversAllocateEntry(&ImageFileName[0].Length, 0x44456656u);
      if( v9 )
      {
        VfDriverLock();
        v10 = (VOID ***)qword_140C1C9F8;
        if( *(__int64 **)qword_140C1C9F8 != &VfExcludedDriversList )
          __fastfail(3u);
        *v9 = &VfExcludedDriversList;
        v9[1] = v10;
        *v10 = v9;
        qword_140C1C9F8 = (__int64)v9;
        goto LABEL_27;
      }
    }
    v3 = 0x100002601i64;
    goto LABEL_30;
  }
}

Referenced by: