VfCheckImageCompliance

VOID __fastcall VfCheckImageCompliance(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  int v2; 
  IMAGE_NT_HEADERS *v3; 
  IMAGE_NT_HEADERS *v4; 
  UINT64 Param3; 
  _IMAGE_DATA_DIRECTORY *v6; 
  unsigned int v7; 
  unsigned int v8; 
  unsigned __int16 Magic; 
  int SectionAlignment; 
  char Str1[8]; 
  char v12; 
  v2 = 1;
  if( (MmVerifierData & 0x2000000) != 0 )
  {
    v3 = RtlImageNtHeader(*((PVOID *)DataTableEntry + 6));
    v4 = v3;
    if( v3 )
    {
      Param3 = (UINT64)&v3->OptionalHeader + v3->FileHeader.SizeOfOptionalHeader;
      v6 = &v3->OptionalHeader.DataDirectory[12];
      if( !v3->OptionalHeader.DataDirectory[12].VirtualAddress || !v3->OptionalHeader.DataDirectory[12].Size )
        v2 = 0;
      v7 = 0;
      if( v3->FileHeader.NumberOfSections )
      {
        do
        {
          if( (*(_DWORD *)(Param3 + 36) & 0xA0000000) == -1610612736 )
          {
            *(_QWORD *)Str1 = *(_QWORD *)Param3;
            v12 = 0;
            if( stricmp(Str1, "INIT") || (VfOptionFlags & 0x100) != 0 )
            {
              ViCiPreprocessOptions(
                &Response,
                "The image %wZ contains an executable and writable section 0x%p(name %s).",
                0x2003ui64,
                (UINT64)DataTableEntry + 88,
                Param3,
                (UINT64)Str1);
              VfReportIssueWithOptions(
                0xC4ui64,
                0x2003ui64,
                (UINT64)DataTableEntry + 88,
                Param3,
                (UINT64)Str1,
                &Response);
              if( (MmVerifierData & 0x1000) != 0 )
                ViTargetIncrementCounter(*((PVOID *)DataTableEntry + 7), 0x11Cui64);
              _InterlockedIncrement(&dword_140C2A6BC);
            }
          }
          if( v2 )
          {
            v8 = *(_DWORD *)(Param3 + 12);
            if( v8 <= v6->VirtualAddress
              && *(_DWORD *)(Param3 + 8) + v8 > v6->VirtualAddress
              && (*(_DWORD *)(Param3 + 36) & 0x20000000) != 0 )
            {
              *(_QWORD *)Str1 = *(_QWORD *)Param3;
              v12 = 0;
              ViCiPreprocessOptions(
                &byte_140C12C88,
                "The image %wZ contains an IAT, 0x%p in executable section(name %s).",
                0x2005ui64,
                (UINT64)DataTableEntry + 88,
                (UINT64)v6,
                (UINT64)Str1);
              VfReportIssueWithOptions(
                0xC4ui64,
                0x2005ui64,
                (UINT64)DataTableEntry + 88,
                (UINT64)v6,
                (UINT64)Str1,
                &byte_140C12C88);
              if( (MmVerifierData & 0x1000) != 0 )
                ViTargetIncrementCounter(*((PVOID *)DataTableEntry + 7), 0x124ui64);
              _InterlockedIncrement(&dword_140C2A6C4);
            }
          }
          Magic = v4->OptionalHeader.Magic;
          if( Magic == 267 || Magic == 523 )
            SectionAlignment = v4->OptionalHeader.SectionAlignment;
          else
            SectionAlignment = 4096;
          if( !SectionAlignment || (SectionAlignment & 0xFFF) != 0 )
          {
            *(_QWORD *)Str1 = *(_QWORD *)Param3;
            v12 = 0;
            ViCiPreprocessOptions(
              &dword_140C12C7C,
              "The image %wZ contains section 0x%p that is not page aligned(name %s).",
              0x2004ui64,
              (UINT64)DataTableEntry + 88,
              Param3,
              (UINT64)Str1);
            VfReportIssueWithOptions(
              0xC4ui64,
              0x2004ui64,
              (UINT64)DataTableEntry + 88,
              Param3,
              (UINT64)Str1,
              &dword_140C12C7C);
            if( (MmVerifierData & 0x1000) != 0 )
              ViTargetIncrementCounter(*((PVOID *)DataTableEntry + 7), 0x120ui64);
            _InterlockedIncrement(&dword_140C2A6C0);
          }
          Param3 += 40i64;
          ++v7;
        }
        while( v7 < v4->FileHeader.NumberOfSections );
      }
    }
  }
}

Referenced by: