VfTargetDriversRemove
void __fastcall VfTargetDriversRemove(__int64 a1){
void *v2;
void *v3;
CHAR *v4;
__m128i *v5;
_VF_TARGET_VERIFIED_DRIVER_DATA *v6;
__m128i v7;
__m128i v8;
__int128 v9;
INT64 v10[2];
INT64 result[2];
__m128i v12;
__int128 v13;
PVOID P[2];
memset((INT64)result, 0i64);
if( !VfSafeMode && ViTargetInitialized )
{
v2 = *(void **)(a1 + 48);
*(_OWORD *)v10 = 0i64;
v3 = 0i64;
BYTE1(v10[1]) = 4;
v4 = VfAvlLookupTreeNode(&ViTargetDriversAvl, (INT64)v10, (UINT64)v2, 1i64);
v5 = (__m128i *)v4;
if( v4 )
{
v6 = (_VF_TARGET_VERIFIED_DRIVER_DATA *)*((_QWORD *)v4 + 7);
if( v6 )
{
ViTargetRemovingCheckEtwWmi(*((_VF_TARGET_VERIFIED_DRIVER_DATA **)v4 + 7), v2);
VfPoolCheckForLeaks(v6, (_KLDR_DATA_TABLE_ENTRY *)a1);
ViTargetRemovingCheckContiguousMemory((UINT64)v6, a1);
}
v7 = *v5;
v12 = v5[1];
v8 = v5[3];
*(__m128i *)result = v7;
v9 = (__int128)v5[2];
*(__m128i *)P = v8;
v13 = v9;
if( _mm_srli_si128(v8, 8).m128i_u64[0] )
--dword_140C1CEE8;
v3 = (void *)VfAvlDeleteTreeNode((INT64)&ViTargetDriversAvl, (INT64)v10, (UINT64)v2, 1i64);
}
VfAvlCleanupLockContext((INT64)v10);
if( v3 )
{
VfThunkRemoveTargetNotify((VOID **)result);
if( P[1] )
ExFreePoolWithTag(P[1], 0x44566656u);
if( dword_140C1CEE0 == 1 )
ExFreeToNPagedLookasideList((NPAGED_LOOKASIDE_LIST *)ViAvlNodeLookaside, v3);
else
VfUtilFreePoolCheckIRQL(v3);
}
}
}Referenced by:
VfDriverUnloadImage
VfSuspectDriversLoadCallback