VfDriverLoadImage
VOID __fastcall VfDriverLoadImage(INT64 a1, INT64 a2, UINT8 a3, UINT8 a4){
INT64 v4;
unsigned int v5;
_SECTION *v6;
v4 = a1;
v5 = a3;
v6 = *(_SECTION **)(a1 + 112);
if( v6 )
a3 = *(_BYTE *)(*(_QWORD *)MiSectionControlArea(v6) + 15i64) >> 4;
else
a3 = 12;
if( ViVerifierDriverAddedThunkListHead.Flink )
{
VfSuspectDriversLoadCallback((_KLDR_DATA_TABLE_ENTRY *)v4, (_VF_SUSPECT_DRIVER_ENTRY *)a2, a3, v5);
}
else if( !a4 )
{
VfTargetDriversAdd(*(VOID **)(v4 + 48), *(unsigned int *)(v4 + 64), (_VF_SUSPECT_DRIVER_ENTRY *)a3);
}
}Referenced by:
MiFinalizeDriverImage
VfDriverEnableVerifier
VfDriverLoadBootDrivers
VfInitBootDriversLoaded