VfTargetDriversAdd

UINT64 __stdcall VfTargetDriversAdd(VOID *Start, UINT64 Size, _VF_SUSPECT_DRIVER_ENTRY *SuspectDriverEntry){
  _VF_SUSPECT_DRIVER_ENTRY *v3; 
  __int64 v4; 
  UINT64 v5; 
  char v6; 
  unsigned int v8; 
  _VF_AVL_TREE_NODE *v9; 
  _VF_TARGET_VERIFIED_DRIVER_DATA *VerifiedData; 
  union {struct {unsigned __int32 MissedEtwRegistration : 1;unsigned __int32 IsBootDriver : 1;unsigned __int32 Spare : 30;} Flags;unsigned int Whole;} v12; 
  unsigned int v13; 
  _VF_AVL_LOCK_CONTEXT LockContext[4]; 

  v4 = 0i64;
  v5 = (unsigned int)Size;
  v6 = (char)SuspectDriverEntry;
  v8 = 1;
  if( VfSafeMode || !ViTargetInitialized )
    return 0;
  if( !v3 )
    goto LABEL_4;
  VerifiedData = ViTargetDriversAllocateVerifiedData(v3);
  v4 = (__int64)VerifiedData;
  if( !VerifiedData )
    return 0;
  v12.Flags = (struct {unsigned __int32 MissedEtwRegistration : 1;unsigned __int32 IsBootDriver : 1;unsigned __int32 Spare : 30;})VerifiedData->u1;
  if( (_DWORD)InitializationPhase )
    v13 = v12.Whole & 0xFFFFFFFD;
  else
    v13 = v12.Whole | 2;
  *(_DWORD *)(v4 + 32) = v13;
LABEL_4:
  v9 = VfAvlReserveNode(&ViTargetDriversAvl, Start, v5);
  if( v9 )
  {
    if( v4 )
      VfNotifyDifPlugins(1, v4);
    v9[3].RangeSize = v4;
    *(_OWORD *)&v9[1].RangeSize = 0i64;
    *(_OWORD *)&v9[2].RangeSize = 0i64;
    VfThunkAddTargetNotify((_VF_TARGET_DRIVER *)v9);
    *(_OWORD *)LockContext = 0i64;
    BYTE1(LockContext[2]) = 4;
    VfAvlInsertReservedTreeNode(&ViTargetDriversAvl, LockContext, v9);
    if( v4 )
    {
      ++dword_140C1CEE8;
      *(_BYTE *)(v4 + 48) = v6;
    }
    VfAvlCleanupLockContext(LockContext);
  }
  else
  {
    _InterlockedExchange(&ViTargetAllocationFailures, 1);
    v8 = 0;
    if( v4 )
      ExFreePoolWithTag((PVOID)v4, 0x44566656u);
  }
  return v8;
}

Referenced by: