VfSuspectDriversLoadCallback

VOID __fastcall VfSuspectDriversLoadCallback(
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry,
        _VF_SUSPECT_DRIVER_ENTRY *Verifier,
        UINT64 KernelEntry,
        UINT64 AlreadyRunning){
  int v4; 
  char v5; 
  _VF_SUSPECT_DRIVER_ENTRY *Flink; 
  int v8; 
  __int64 i; 
  __int64 j; 
  _VF_SUSPECT_DRIVER_ENTRY *v11; 
  int v12; 
  UINT8 v13; 
  int v14; 
  _VF_SUSPECT_DRIVER_ENTRY **v15; 
  int v16; 
  int v17; 
  v4 = AlreadyRunning;
  v5 = KernelEntry;
  Flink = Verifier;
  v8 = 0;
  VfDriverLock((INT64)DataTableEntry, (INT64)Verifier, KernelEntry);
  if( (VfOptionFlags & 1) != 0 )
  {
    for( i = VfExcludedDriversList; (__int64 *)i != &VfExcludedDriversList; i = *(_QWORD *)i )
    {
      if( RtlEqualUnicodeString((UNICODE_STRING *)(i + 16), (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) )
        goto LABEL_58;
    }
  }
  if( (MmVerifyDriverLevel & 0xEF8000) != 0 || (VfRuleClasses & 0x800000000i64) != 0 )
  {
    for( j = VfXdvExcludedDriversList; (__int64 *)j != &VfXdvExcludedDriversList; j = *(_QWORD *)j )
    {
      if( RtlEqualUnicodeString((UNICODE_STRING *)(j + 16), (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) )
        goto LABEL_58;
    }
  }
  if( RtlEqualUnicodeString((UNICODE_STRING *)&VfTcpIpName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) == 1 )
  {
    VfTcpIpDllBase = *((_QWORD *)DataTableEntry + 6);
    VfTcpIpSizeOfImage = *((_DWORD *)DataTableEntry + 16);
  }
  else if( RtlEqualUnicodeString((UNICODE_STRING *)&VfTdxName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) == 1 )
  {
    VfTdxDllBase = *((_QWORD *)DataTableEntry + 6);
    VfTdxSizeOfImage = *((_DWORD *)DataTableEntry + 16);
  }
  else if( RtlEqualUnicodeString((UNICODE_STRING *)VfMrxsmbName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) == 1 )
  {
    VfMrxsmbDllBase = *((_QWORD *)DataTableEntry + 6);
    VfMrxsmbSizeOfImage = *((_DWORD *)DataTableEntry + 16);
  }
  else if( RtlEqualUnicodeString((UNICODE_STRING *)&VfTmName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) == 1 )
  {
    VfTmDllBase = *((_QWORD *)DataTableEntry + 6);
    VfTmSizeOfImage = *((_DWORD *)DataTableEntry + 16);
  }
  else if( RtlEqualUnicodeString((UNICODE_STRING *)&VfWin32kName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) == 1 )
  {
    VfWin32kDllBase = *((_QWORD *)DataTableEntry + 6);
    VfWin32kSizeOfImage = *((_DWORD *)DataTableEntry + 16);
  }
  else if( RtlEqualUnicodeString((UNICODE_STRING *)&VfKsName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u) == 1 )
  {
    VfKsDllBase = *((_QWORD *)DataTableEntry + 6);
    VfKsSizeOfImage = *((_DWORD *)DataTableEntry + 16);
  }
  if( v4 || (v8 = VfThunkApplyMandatoryThunks((__int64)DataTableEntry, v17)) != 0 )
  {
    if( Flink )
    {
LABEL_45:
      v12 = 1;
LABEL_46:
      if( v17 )
      {
        if( v12 )
          v16 = VfTargetDriversEnableVerifier(*((VOID **)DataTableEntry + 6), Flink);
        else
          v16 = 1;
      }
      else
      {
        LOBYTE(v11) = v5;
        v16 = VfTargetDriversAdd(*((VOID **)DataTableEntry + 6), *((unsigned int *)DataTableEntry + 16), v11);
      }
      if( v12 || (v8 = 0, (_DWORD)KernelVerifier) )
      {
        v8 = 0;
        if( v16 )
        {
          v8 = VfThunkApplyThunks((__int64)DataTableEntry, v17);
          if( v8 )
          {
            if( v12 )
            {
              VfUtilPrintCheckinString((_UNICODE_STRING *)((char *)DataTableEntry + 88));
              ++dword_140C2A650;
              ++Flink->Loads;
              VfNotifyVerifierExtensions(1, (__int64)DataTableEntry);
              VfCheckImageCompliance(DataTableEntry);
            }
          }
          else
          {
            VfTargetDriversRemove((__int64)DataTableEntry);
          }
        }
      }
      goto LABEL_58;
    }
    Flink = VfSuspectDriversList;
    v12 = 0;
    while( Flink != (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
    {
      v13 = RtlEqualUnicodeString(&Flink->BaseName, (UNICODE_STRING *)((char *)DataTableEntry + 88), 1u);
      v12 = v13;
      if( v13 )
        goto LABEL_46;
      Flink = (_VF_SUSPECT_DRIVER_ENTRY *)Flink->Links.Flink;
    }
    if( (_DWORD)KernelVerifier )
    {
      if( !v4 )
      {
        v14 = ViForceAllDriversSuspect;
        goto LABEL_42;
      }
    }
    else if( (_DWORD)ViVerifyAllDrivers != 1 )
    {
      if( !VfRandomVerifiedDrivers
        || (++ViLoadedDriversCount, !_bittest((const signed __int32 *)qword_140D491F8, ViLoadedDriversCount)) )
      {
        v14 = 0;
LABEL_42:
        if( !v14 )
        {
          Flink = 0i64;
          goto LABEL_46;
        }
        goto LABEL_38;
      }
      --VfRandomVerifiedDrivers;
    }
LABEL_38:
    Flink = VfSuspectDriversAllocateEntry((_UNICODE_STRING *)((char *)DataTableEntry + 88));
    if( !Flink )
      goto LABEL_46;
    v15 = (_VF_SUSPECT_DRIVER_ENTRY **)qword_140C1D0B8;
    if( *(_VF_SUSPECT_DRIVER_ENTRY ***)qword_140C1D0B8 != &VfSuspectDriversList )
      __fastfail(3u);
    Flink->Links.Flink = (_LIST_ENTRY *)&VfSuspectDriversList;
    Flink->Links.Blink = (_LIST_ENTRY *)v15;
    *v15 = Flink;
    qword_140C1D0B8 = (__int64)Flink;
    goto LABEL_45;
  }
LABEL_58:
  ViDriversLoadLockOwner = 0i64;
  KeReleaseMutex(&ViDriversLoadLock, 0);
  if( v8 )
    *((_DWORD *)DataTableEntry + 26) |= 0x2000000u;
}

Referenced by: