VfSuspectDriversGetVerifierInformation

NTSTATUS __stdcall VfSuspectDriversGetVerifierInformation(
        PVOID SystemVerifierInformation,
        UINT64 SystemInformationLength,
        UINT64 *ReturnedLength,
        PVOID UserModeBuffer,
        UINT64 GetAdditionalCounters){
  char *v6; 
  unsigned int v7; 
  NTSTATUS v8; 
  _VF_SUSPECT_DRIVER_ENTRY *Flink; 
  _VF_SUSPECT_DRIVER_ENTRY *v10; 
  UINT64 Length; 
  __int64 *v12; 
  __int64 v13; 
  char v14; 
  int v15; 
  __int64 v16; 
  __int64 v17; 
  __int16 v18; 
  UINT8 *v19; 
  INT64 v21[2]; 
  __int64 v22[2]; 
  int v23; 
  int v24; 
  unsigned int v26; 
  _VF_SUSPECT_DRIVER_ENTRY *v27; 
  v26 = SystemInformationLength;
  v6 = (char *)SystemVerifierInformation;
  *(_DWORD *)ReturnedLength = 0;
  v7 = 0;
  v8 = 0;
  VfDriverLock((INT64)SystemVerifierInformation, SystemInformationLength, (INT64)ReturnedLength);
  Flink = VfSuspectDriversList;
  if( VfSuspectDriversList != (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
  {
    while( 1 )
    {
      v10 = Flink;
      v6 += v7;
      v27 = Flink;
      Flink = (_VF_SUSPECT_DRIVER_ENTRY *)Flink->Links.Flink;
      Length = v10->BaseName.Length;
      v7 = (Length + ((_DWORD)GetAdditionalCounters != 0 ? 281 : 153)) & 0xFFFFFFF8;
      *(_DWORD *)ReturnedLength += v7;
      if( *(_DWORD *)ReturnedLength > v26 )
        break;
      *(_DWORD *)v6 = v7;
      v12 = &VfRuleClasses;
      *((_DWORD *)v6 + 1) = MmVerifierData;
      v13 = 2i64;
      do
      {
        *(_DWORD *)((char *)v12 + v6 - (char *)&VfRuleClasses + 8) = *(_DWORD *)v12;
        v12 = (__int64 *)((char *)v12 + 4);
        --v13;
      }
      while( v13 );
      v14 = VfClearanceFlag;
      *((_DWORD *)v6 + 4) = VfTriageContext;
      *((_DWORD *)v6 + 5) = ViVerifyAllDrivers & 1 | *((_DWORD *)v6 + 5) & 0xFFFFFFFC | (2 * (v14 & 1));
      *((_DWORD *)v6 + 10) = dword_140C2A624;
      *((_DWORD *)v6 + 11) = dword_140C2A628;
      *((_DWORD *)v6 + 23) = dword_140C2A658;
      *((_DWORD *)v6 + 12) = dword_140C2A62C;
      *((_DWORD *)v6 + 13) = dword_140C2A630;
      *((_DWORD *)v6 + 14) = dword_140C2A634;
      *((_DWORD *)v6 + 15) = dword_140C2A638;
      *((_DWORD *)v6 + 16) = dword_140C2A63C;
      *((_DWORD *)v6 + 17) = dword_140C2A640;
      *((_DWORD *)v6 + 18) = dword_140C2A644;
      *((_DWORD *)v6 + 19) = dword_140C2A648;
      *((_DWORD *)v6 + 20) = dword_140C2A64C;
      *((_DWORD *)v6 + 21) = v10->Loads;
      *((_DWORD *)v6 + 22) = v10->Unloads;
      if( v10->Loads <= v10->Unloads )
      {
        VfTargetDriversGetZeroCounters(v6, GetAdditionalCounters);
      }
      else
      {
        *(_OWORD *)v21 = 0i64;
        v24 = 0;
        VfTargetDriversGetZeroCounters(v6, GetAdditionalCounters);
        v22[0] = v16;
        v22[1] = (__int64)v6;
        v23 = GetAdditionalCounters;
        VfAvlInitializeLockContext((INT64)v21, (unsigned int)(v15 + 1));
        VfAvlEnumerateNodes(
          v17,
          (__int64)v21,
          (unsigned int(__fastcall *)(PVOID, __int64))ViTargetAddCountersCallback,
          (__int64)v22);
        VfAvlCleanupLockContext((INT64)v21);
        v18 = 2;
      }
      *((_WORD *)v6 + 12) = Length;
      *((_WORD *)v6 + 13) = v18 + Length;
      v19 = (UINT8 *)&v6[(_DWORD)GetAdditionalCounters != 0 ? 272 : 144];
      *((_QWORD *)v6 + 4) = v19;
      memmove(v19, (UINT8 *)v27->BaseName.Buffer, Length);
      *(_WORD *)(*((_QWORD *)v6 + 4) + 2 * (Length >> 1)) = 0;
      *((_QWORD *)v6 + 4) += (_BYTE *)UserModeBuffer - (_BYTE *)SystemVerifierInformation;
      if( Flink == (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
        goto LABEL_11;
    }
    v8 = -1073741820;
  }
LABEL_11:
  ViDriversLoadLockOwner = 0i64;
  KeReleaseMutex(&ViDriversLoadLock, 0);
  if( v8 >= 0 )
    *(_DWORD *)v6 = 0;
  return v8;
}

Referenced by: