VfTriageAddDrivers

UINT64 __fastcall VfTriageAddDrivers(VOID *OpaqueLoaderBlock){
  _DWORD *v3; 
  unsigned int v4; 
  unsigned int i; 
  char *LoaderEntry; 
  _UNICODE_STRING *v7; 
  INT64 v8; 
  INT64 v9; 
  _VF_SUSPECT_DRIVER_ENTRY *Entry; 
  INT64 v11; 
  UINT64 DriverCount; 
  LODWORD(DriverCount) = 0;
  if( (VerifierTriageActionTaken & 0x40000000) == 0 )
  {
    DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: no suspect drivers will be selected for verification.\n");
    return 0i64;
  }
  DbgPrintEx(0x5Du, 3u, "CRASH TRIAGE: will select target drivers for verification.\n");
  v3 = *(_DWORD **)(*((_QWORD *)OpaqueLoaderBlock + 30) + 40i64);
  if( TriageGetDriverCount(v3, &DriverCount) < 0 )
    return 0i64;
  v4 = 0;
  for( i = 0; i < (unsigned int)DriverCount; ++i )
  {
    LoaderEntry = TriageGetLoaderEntry(v3, i);
    if( LoaderEntry && (*((_DWORD *)LoaderEntry + 26) & 0x8000000) == 0 )
    {
      v7 = (_UNICODE_STRING *)(LoaderEntry + 88);
      DbgPrintEx(0x5Du, 3u, "VfTriageAddDrivers: Marking %wZ for verification when it is loaded\n", LoaderEntry + 88);
      Entry = VfSuspectDriversAllocateEntry(v7);
      if( Entry )
      {
        VfDriverLock(v9, v8, v11);
        VfSuspectDriversInsert(Entry);
        VfDriverUnlock();
        v4 = 1;
      }
    }
  }
  return v4;
}

Referenced by: