ViInitSystemPhase0

VOID __stdcall ViInitSystemPhase0(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  __int64 v1; 
  __int64 v3; 
  int v4; 
  int v5; 
  CHAR *v6; 
  wchar_t *v7; 
  int v8; 
  unsigned int v9; 
  UINT8 *v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  wchar_t *v13; 
  unsigned __int64 v14; 
  int v15; 
  UNICODE_STRING String2; 
  String2 = 0i64;
  v1 = *((_QWORD *)LoaderBlock + 30);
  v3 = *(_QWORD *)(v1 + 280);
  v4 = *(_DWORD *)(v1 + 132) & 2;
  v5 = VfOptionFlags & 0x7FF;
  VfOptionFlags = v5;
  if( (v5 & 4) != 0 )
    MmVerifierTrimFrequency = 7;
  if( (v5 & 0x80u) != 0 )
    VfDisableCodeIntegrityBreaks();
  KiInitializeMutant(&ViDriversLoadLock, 0, 1u);
  qword_140C1D0B8 = (__int64)&VfSuspectDriversList;
  VfSuspectDriversList = (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList;
  qword_140C1C9F8 = (__int64)&VfExcludedDriversList;
  VfExcludedDriversList = (__int64)&VfExcludedDriversList;
  qword_140C1C9E8 = (__int64)&VfXdvExcludedDriversList;
  VfXdvExcludedDriversList = (__int64)&VfXdvExcludedDriversList;
  if( VfVerifyMode == -1 )
  {
    VfVerifyMode = (MmVerifierData & 0x400000) != 0 ? 2 : 4;
    dword_140C2A69C = VfVerifyMode;
  }
  if( MmVerifyDriverLevel == -1 )
  {
    if( (_DWORD)VfRuleClasses )
    {
      MmVerifyDriverLevel = 0;
      VfRuleClasses = 0i64;
      MmVerifyDriverBufferLength = -1;
      VfRandomVerifiedDrivers = 0;
      LODWORD(ViVerifyAllDrivers) = 0;
      VfSafeMode = 1;
      if( (VfOptionFlags & 0x410) != 0 )
        VfClearanceFlag = 1;
      return;
    }
  }
  else
  {
    LODWORD(VfRuleClasses) = MmVerifyDriverLevel;
  }
  if( !v4 && v3 )
  {
    *(_QWORD *)&VfBugcheckTmpData = *(unsigned int *)(v3 + 56);
    BugCheckParameter1 = *(_QWORD *)(v3 + 64);
    qword_140D49038 = *(_QWORD *)(v3 + 72);
    *(_OWORD *)&xmmword_140D49040 = *(_OWORD *)(v3 + 80);
  }
  if( (VfOptionFlags & 0x410) == 0
    || MmVerifyDriverLevel == -1
    || ((MmVerifyDriverBufferLength + 1) & 0xFFFFFFFE) == 0 && !VfRandomVerifiedDrivers
    || (v8 = 1, v4) )
  {
    v8 = 0;
  }
  v6 = (CHAR *)*((_QWORD *)LoaderBlock + 27);
  VfClearanceFlag = v8;
  if( strstr(v6, "SAFEBOOT:") || VfClearanceFlag )
  {
    VfRuleClassesRecord = VfRuleClasses;
    MmVerifyDriverLevel = 0;
    VfRuleClasses = 0i64;
    MmVerifyDriverBufferLength = -1;
    VfRandomVerifiedDrivers = 0;
    LODWORD(ViVerifyAllDrivers) = 0;
    VfSafeMode = 1;
    return;
  }
  VfTriageSystem(LoaderBlock);
  if( MmVerifyDriverLevel == -1 )
    goto LABEL_15;
  if( !VfRandomVerifiedDrivers && MmVerifyDriverBufferLength == -1 )
    VfInitSetVerifyDriverTargets((PWCHAR)L"*", 4ui64);
  if( MmVerifyDriverLevel == -1 || (MmVerifyDriverLevel & 0x400000) == 0 )
LABEL_15:
    VfRandomVerifiedDrivers = 0;
  if( VfRandomVerifiedDrivers )
  {
    v9 = HIWORD(VfRandomVerifiedDrivers);
    ViExpectedDriversCount = v9;
    HIWORD(VfRandomVerifiedDrivers) = 0;
    if( v9 >= 3 )
    {
      if( v9 > 0x200 )
        ViExpectedDriversCount = 512;
    }
    else
    {
      ViExpectedDriversCount = 256;
    }
  }
  ViRandomSeed = KeQueryPerformanceCounter(0i64).LowPart;
  if( (_DWORD)ViVerifyAllDrivers == 1 )
    goto LABEL_43;
  if( (_DWORD)ViVerifyAllDrivers == 2 )
  {
    LODWORD(ViVerifyAllDrivers) = 1;
    LODWORD(KernelVerifier) = 1;
    ViForceAllDriversSuspect = 1;
LABEL_43:
    MmVerifyDriverBufferLength = 0;
    goto LABEL_44;
  }
  if( MmVerifyDriverBufferLength == -1 )
  {
    if( !(unsigned int)ViInitPickRandomTargets() )
      return;
    MmVerifyDriverBufferLength = 0;
    if( VfVerifyMode > 2 )
      VfSetVerifierRunningMode(2);
    goto LABEL_45;
  }
LABEL_44:
  VfRandomVerifiedDrivers = 0;
LABEL_45:
  if( (VfOptionFlags & 1) != 0 && !VfRandomVerifiedDrivers )
  {
LABEL_75:
    LODWORD(ViVerifyAllDrivers) = 1;
  }
  else if( !(_DWORD)ViVerifyAllDrivers && !VfRandomVerifiedDrivers )
  {
    v7 = (wchar_t *)&MmVerifyDriverBuffer;
    v10 = &MmVerifyDriverBuffer + 2 * (((unsigned __int64)(unsigned int)MmVerifyDriverBufferLength - 2) >> 1);
    if( &MmVerifyDriverBuffer < v10 )
    {
      v11 = 0x100002601i64;
      do
      {
        v12 = *v7;
        if( (unsigned int)v12 <= 0x20 && _bittest64(&v11, v12) || (_WORD)v12 == 12288 )
        {
          v13 = v7;
        }
        else
        {
          if( (_DWORD)v12 == 42 )
            goto LABEL_75;
          v13 = v7 + 1;
          if( (_DWORD)v12 == 34 )
          {
            ++v7;
            if( ++v13 >= (wchar_t *)v10 )
              break;
            do
            {
              if( *v13 == 34 )
                break;
              ++v13;
            }
            while( v13 < (wchar_t *)v10 );
            if( v13 >= (wchar_t *)v10 )
              break;
          }
          else
          {
            while( v13 < (wchar_t *)v10 )
            {
              v14 = *v13;
              if( (unsigned int)v14 <= 0x20 )
              {
                if( _bittest64(&v11, v14) )
                  break;
              }
              if( (_WORD)v14 == 12288 )
                break;
              ++v13;
            }
          }
          v15 = 2 * (v13 - v7);
          if( v15 )
          {
            String2.Length = 2 * (v13 - v7);
            String2.MaximumLength = v15 + 2;
            if( (unsigned __int16)(v15 + 2) < (unsigned __int16)v15 )
              break;
            String2.Buffer = v7;
            if( RtlEqualUnicodeString((UNICODE_STRING *)&VfKernelImageName, &String2, 1u) )
            {
              LODWORD(KernelVerifier) = 1;
              break;
            }
          }
        }
        v7 = v13 + 1;
      }
      while( v13 + 1 < (wchar_t *)v10 );
    }
  }
  VfInitSystemNoRebootNeeded((UINT64)v7, 1ui64);
}

Referenced by: