VfTriageAddDrivers

UINT64 __stdcall VfTriageAddDrivers(VOID *OpaqueLoaderBlock){
  void *v3; 
  unsigned int v4; 
  unsigned int i; 
  _KLDR_DATA_TABLE_ENTRY *LoaderEntry; 
  _UNICODE_STRING *p_BaseDllName; 
  _VF_SUSPECT_DRIVER_ENTRY *Entry; 
  UINT64 DriverCount; 

  LODWORD(DriverCount) = 0;
  if( (VerifierTriageActionTaken & 0x40000000) == 0 )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: no suspect drivers will be selected for verification.\n");
    return 0i64;
  }
  DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: will select target drivers for verification.\n");
  v3 = *(void **)(*((_QWORD *)OpaqueLoaderBlock + 30) + 40i64);
  if( TriageGetDriverCount(v3, &DriverCount) < 0 )
    return 0i64;
  v4 = 0;
  for( i = 0; i < (unsigned int)DriverCount; ++i )
  {
    LoaderEntry = TriageGetLoaderEntry(v3, i);
    if( LoaderEntry && (LoaderEntry->Flags & 0x8000000) == 0 )
    {
      p_BaseDllName = &LoaderEntry->BaseDllName;
      DbgPrintEx(
        0x5Du,
        3u,
        "VfTriageAddDrivers: Marking %wZ for verification when it is loaded\n",
        &LoaderEntry->BaseDllName);
      Entry = VfSuspectDriversAllocateEntry(p_BaseDllName);
      if( Entry )
      {
        VfDriverLock();
        VfSuspectDriversInsert(Entry);
        VfDriverUnlock();
        v4 = 1;
      }
    }
  }
  return v4;
}

Referenced by: