VfSuspectDriversGetVerifierInformation

NTSTATUS __stdcall VfSuspectDriversGetVerifierInformation(
        VOID *SystemVerifierInformation,
        UINT64 SystemInformationLength,
        UINT64 *ReturnedLength,
        VOID *UserModeBuffer,
        UINT64 GetAdditionalCounters){
  char *v6; 
  unsigned int v7; 
  NTSTATUS v8; 
  _VF_SUSPECT_DRIVER_ENTRY *Flink; 
  _VF_SUSPECT_DRIVER_ENTRY *v10; 
  unsigned __int64 Length; 
  _DWORD *v12; 
  __int64 v13; 
  char v14; 
  int v15; 
  void *v16; 
  _VF_AVL_TREE *v17; 
  __int16 v18; 
  char *v19; 
  _VF_AVL_LOCK_CONTEXT Context[4]; 
  _VF_AVL_TREE_NODE a4; 
  int v23; 
  int v24; 
  unsigned int v26; 
  _VF_SUSPECT_DRIVER_ENTRY *v27; 

  v26 = SystemInformationLength;
  v6 = (char *)SystemVerifierInformation;
  *(_DWORD *)ReturnedLength = 0;
  v7 = 0;
  v8 = 0;
  VfDriverLock();
  Flink = VfSuspectDriversList;
  if( VfSuspectDriversList != (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
  {
    while( 1 )
    {
      v10 = Flink;
      v6 += v7;
      v27 = Flink;
      Flink = (_VF_SUSPECT_DRIVER_ENTRY *)Flink->Links.Flink;
      Length = v10->BaseName.Length;
      v7 = (Length + ((_DWORD)GetAdditionalCounters != 0 ? 281 : 153)) & 0xFFFFFFF8;
      *(_DWORD *)ReturnedLength += v7;
      if( *(_DWORD *)ReturnedLength > v26 )
        break;
      *(_DWORD *)v6 = v7;
      v12 = (_DWORD *)((char *)&stru_140CF2E80 + 7304);
      *((_DWORD *)v6 + 1) = MmVerifierData;
      v13 = 2i64;
      do
      {
        *(_DWORD *)((char *)v12 + v6 - ((char *)&stru_140CF2E80 + 7304) + 8) = *v12;
        ++v12;
        --v13;
      }
      while( v13 );
      v14 = VfClearanceFlag;
      *((_DWORD *)v6 + 4) = VfTriageContext;
      *((_DWORD *)v6 + 5) = ViVerifyAllDrivers & 1 | *((_DWORD *)v6 + 5) & 0xFFFFFFFC | (2 * (v14 & 1));
      *((_DWORD *)v6 + 10) = dword_140C2A624;
      *((_DWORD *)v6 + 11) = dword_140C2A628;
      *((_DWORD *)v6 + 23) = dword_140C2A658;
      *((_DWORD *)v6 + 12) = dword_140C2A62C;
      *((_DWORD *)v6 + 13) = dword_140C2A630;
      *((_DWORD *)v6 + 14) = dword_140C2A634;
      *((_DWORD *)v6 + 15) = dword_140C2A638;
      *((_DWORD *)v6 + 16) = dword_140C2A63C;
      *((_DWORD *)v6 + 17) = dword_140C2A640;
      *((_DWORD *)v6 + 18) = dword_140C2A644;
      *((_DWORD *)v6 + 19) = dword_140C2A648;
      *((_DWORD *)v6 + 20) = dword_140C2A64C;
      *((_DWORD *)v6 + 21) = v10->Loads;
      *((_DWORD *)v6 + 22) = v10->Unloads;
      if( v10->Loads <= v10->Unloads )
      {
        VfTargetDriversGetZeroCounters(v6, GetAdditionalCounters);
      }
      else
      {
        *(_OWORD *)Context = 0i64;
        v24 = 0;
        VfTargetDriversGetZeroCounters(v6, GetAdditionalCounters);
        a4.p = v16;
        a4.RangeSize = (unsigned __int64)v6;
        v23 = GetAdditionalCounters;
        VfAvlInitializeLockContext(Context, (_VF_AVL_LOCK_TYPE)(v15 + 1));
        VfAvlEnumerateNodes(
          v17,
          Context,
          (UINT64 *)ViTargetAddCountersCallback,
          &a4,
          *(VOID **)Context,
          *(VOID **)&Context[2]);
        VfAvlCleanupLockContext(Context);
        v18 = 2;
      }
      *((_WORD *)v6 + 12) = Length;
      *((_WORD *)v6 + 13) = v18 + Length;
      v19 = &v6[(_DWORD)GetAdditionalCounters != 0 ? 272 : 144];
      *((_QWORD *)v6 + 4) = v19;
      memmove(v19, v27->BaseName.Buffer, Length);
      *(_WORD *)(*((_QWORD *)v6 + 4) + 2 * (Length >> 1)) = 0;
      *((_QWORD *)v6 + 4) += (_BYTE *)UserModeBuffer - (_BYTE *)SystemVerifierInformation;
      if( Flink == (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
        goto LABEL_11;
    }
    v8 = -1073741820;
  }
LABEL_11:
  ViDriversLoadLockOwner = 0i64;
  KeReleaseMutex(&ViDriversLoadLock, 0);
  if( v8 >= 0 )
    *(_DWORD *)v6 = 0;
  return v8;
}

Referenced by: