VfSuspectDriversParseRegistryString

VOID __stdcall VfSuspectDriversParseRegistryString(){
  wchar_t *v0; 
  BOOL v1; 
  UINT8 *v2; 
  __int64 v3; 
  unsigned __int64 v4; 
  wchar_t *v5; 
  unsigned __int64 v6; 
  int v7; 
  INT64 v8; 
  INT64 v9; 
  _VF_SUSPECT_DRIVER_ENTRY *v10; 
  INT64 v11; 
  INT64 v12; 
  INT64 v13; 
  char *Entry; 
  INT64 v15; 
  char **v16; 
  _UNICODE_STRING ImageFileName; 
  v0 = (wchar_t *)&MmVerifyDriverBuffer;
  ImageFileName = 0i64;
  v1 = (VfOptionFlags & 1) == 0;
  v2 = &MmVerifyDriverBuffer + 2 * (((unsigned __int64)(unsigned int)MmVerifyDriverBufferLength - 2) >> 1);
  if( &MmVerifyDriverBuffer < v2 )
  {
    v3 = 0x100002601i64;
    while( 1 )
    {
      v4 = *v0;
      if( (unsigned int)v4 <= 0x20 && _bittest64(&v3, v4) || (_WORD)v4 == 12288 )
      {
        v5 = v0;
        goto LABEL_30;
      }
      if( (_DWORD)v4 == 42 && v1 )
      {
        LODWORD(ViVerifyAllDrivers) = 1;
        return;
      }
      v5 = v0 + 1;
      if( (_DWORD)v4 == 34 )
      {
        ++v0;
        if( ++v5 >= (wchar_t *)v2 )
          return;
        do
        {
          if( *v5 == 34 )
            break;
          ++v5;
        }
        while( v5 < (wchar_t *)v2 );
        if( v5 >= (wchar_t *)v2 )
          return;
      }
      else
      {
        while( v5 < (wchar_t *)v2 )
        {
          v6 = *v5;
          if( (unsigned int)v6 <= 0x20 )
          {
            if( _bittest64(&v3, v6) )
              break;
          }
          if( (_WORD)v6 == 12288 )
            break;
          ++v5;
        }
      }
      v7 = 2 * (v5 - v0);
      if( v7 )
        break;
LABEL_30:
      v0 = v5 + 1;
      if( v5 + 1 >= (wchar_t *)v2 )
        return;
    }
    ImageFileName.Length = 2 * (v5 - v0);
    ImageFileName.MaximumLength = v7 + 2;
    if( (unsigned __int16)(v7 + 2) < (unsigned __int16)v7 )
      return;
    ImageFileName.Buffer = v0;
    if( v1 )
    {
      v10 = VfSuspectDriversAllocateEntry(&ImageFileName);
      if( v10 )
      {
        VfDriverLock(v9, v8, v11);
        VfSuspectDriversInsert(v10);
LABEL_27:
        VfDriverUnlock();
      }
    }
    else
    {
      Entry = VfSuspectExcludedDriversAllocateEntry(&ImageFileName.Length, 0x44456656u);
      if( Entry )
      {
        VfDriverLock(v13, v12, v15);
        v16 = (char **)qword_140C1C9F8;
        if( *(__int64 **)qword_140C1C9F8 != &VfExcludedDriversList )
          __fastfail(3u);
        *(_QWORD *)Entry = &VfExcludedDriversList;
        *((_QWORD *)Entry + 1) = v16;
        *v16 = Entry;
        qword_140C1C9F8 = (__int64)Entry;
        goto LABEL_27;
      }
    }
    v3 = 0x100002601i64;
    goto LABEL_30;
  }
}

Referenced by: