VfAddVerifierEntry

INT64 __fastcall VfAddVerifierEntry(_UNICODE_STRING *ImageFileName){
  INT64 v1; 
  INT64 v2; 
  unsigned int v4; 
  UINT64 v5; 
  WCHAR v6; 
  _ETHREAD *Lock; 
  _VF_SUSPECT_DRIVER_ENTRY *Entry; 
  _VF_SUSPECT_DRIVER_ENTRY *v9; 
  struct _UNICODE_STRING DestinationString; 
  UINT64 EntryInserted; 
  LODWORD(EntryInserted) = 0;
  DestinationString = 0i64;
  if( VfSafeMode )
  {
    return(unsigned int)-1073740961;
  }
  else
  {
    VfDriverLock((INT64)ImageFileName, v1, v2);
    VfInitSystemNoRebootNeeded(v5, 0i64);
    ViDriversLoadLockOwner = 0i64;
    KeReleaseMutex(&ViDriversLoadLock, 0);
    RtlInitUnicodeString(&DestinationString, L"*", v6);
    if( RtlEqualUnicodeString(&DestinationString, ImageFileName, 1u) )
    {
      Lock = MmAcquireLoadLock();
      v4 = VfDriverEnableVerifierForAll();
      MmReleaseLoadLock(Lock);
    }
    else
    {
      Entry = VfSuspectDriversAllocateEntry(ImageFileName);
      v9 = Entry;
      if( Entry )
      {
        v4 = MmEnableVerifierForDriver(Entry, &EntryInserted);
        if( !(_DWORD)EntryInserted )
          ExFreePoolWithTag(v9, 0);
      }
      else
      {
        return(unsigned int)-1073741670;
      }
    }
  }
  return v4;
}

Referenced by: