VfTargetDriversAdd

INT64 __fastcall VfTargetDriversAdd(VOID *Start, UINT64 Size, _VF_SUSPECT_DRIVER_ENTRY *SuspectDriverEntry){
  _VF_SUSPECT_DRIVER_ENTRY *v3; 
  __int64 v4; 
  INT64 v5; 
  char v6; 
  unsigned int v8; 
  CHAR *v9; 
  _VF_TARGET_VERIFIED_DRIVER_DATA *VerifiedData; 
  int v12; 
  unsigned int v13; 
  INT64 v14[2]; 
  v4 = 0i64;
  v5 = (unsigned int)Size;
  v6 = (char)SuspectDriverEntry;
  v8 = 1;
  if( VfSafeMode || !ViTargetInitialized )
    return 0;
  if( !v3 )
    goto LABEL_4;
  VerifiedData = ViTargetDriversAllocateVerifiedData(v3);
  v4 = (__int64)VerifiedData;
  if( !VerifiedData )
    return 0;
  v12 = *((_DWORD *)VerifiedData + 8);
  if( *(_DWORD *)InitializationPhase )
    v13 = v12 & 0xFFFFFFFD;
  else
    v13 = v12 | 2;
  *(_DWORD *)(v4 + 32) = v13;
LABEL_4:
  v9 = VfAvlReserveNode((INT64)&ViTargetDriversAvl, (INT64)Start, v5);
  if( v9 )
  {
    if( v4 )
      VfNotifyDifPlugins(1, v4);
    *((_QWORD *)v9 + 7) = v4;
    *(_OWORD *)(v9 + 24) = 0i64;
    *(_OWORD *)(v9 + 40) = 0i64;
    VfThunkAddTargetNotify((INT64)v9);
    *(_OWORD *)v14 = 0i64;
    BYTE1(v14[1]) = 4;
    VfAvlInsertReservedTreeNode((INT64)&ViTargetDriversAvl, (INT64)v14, (UINT64 *)v9);
    if( v4 )
    {
      ++dword_140C1CEE8;
      *(_BYTE *)(v4 + 48) = v6;
    }
    VfAvlCleanupLockContext((INT64)v14);
  }
  else
  {
    _InterlockedExchange(&ViTargetAllocationFailures, 1);
    v8 = 0;
    if( v4 )
      ExFreePoolWithTag((PVOID)v4, 0x44566656u);
  }
  return v8;
}

Referenced by: