VfSuspectDriversLoadCallback

VOID __stdcall VfSuspectDriversLoadCallback(
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry,
        _VF_SUSPECT_DRIVER_ENTRY *Verifier,
        UINT64 KernelEntry,
        UINT64 AlreadyRunning){
  int v4; 
  char v5; 
  int v8; 
  __int64 i; 
  __int64 j; 
  _VF_SUSPECT_DRIVER_ENTRY *v11; 
  int v12; 
  unsigned __int8 v13; 
  int v14; 
  _LIST_ENTRY *v15; 
  int v16; 
  unsigned int AlreadyRunninga; 

  v4 = AlreadyRunning;
  v5 = KernelEntry;
  v8 = 0;
  VfDriverLock();
  if( (VfOptionFlags & 1) != 0 )
  {
    for( i = VfExcludedDriversList; (__int64 *)i != &VfExcludedDriversList; i = *(_QWORD *)i )
    {
      if( (unsigned __int8)RtlEqualUnicodeString((PCUNICODE_STRING)(i + 16), &DataTableEntry->BaseDllName, 1u) )
        goto LABEL_58;
    }
  }
  if( (MmVerifyDriverLevel & 0xEF8000) != 0 || (*(&stru_140CF2E80 + 7308) & 8) != 0 )
  {
    for( j = VfXdvExcludedDriversList; (__int64 *)j != &VfXdvExcludedDriversList; j = *(_QWORD *)j )
    {
      if( (unsigned __int8)RtlEqualUnicodeString((PCUNICODE_STRING)(j + 16), &DataTableEntry->BaseDllName, 1u) )
        goto LABEL_58;
    }
  }
  if( (unsigned __int8)RtlEqualUnicodeString(&VfTcpIpName, &DataTableEntry->BaseDllName, 1u) == 1 )
  {
    VfTcpIpDllBase = (__int64)DataTableEntry->DllBase;
    VfTcpIpSizeOfImage = DataTableEntry->SizeOfImage;
  }
  else if( (unsigned __int8)RtlEqualUnicodeString(&VfTdxName, &DataTableEntry->BaseDllName, 1u) == 1 )
  {
    VfTdxDllBase = (__int64)DataTableEntry->DllBase;
    VfTdxSizeOfImage = DataTableEntry->SizeOfImage;
  }
  else if( (unsigned __int8)RtlEqualUnicodeString(&VfMrxsmbName, &DataTableEntry->BaseDllName, 1u) == 1 )
  {
    VfMrxsmbDllBase = (__int64)DataTableEntry->DllBase;
    VfMrxsmbSizeOfImage = DataTableEntry->SizeOfImage;
  }
  else if( (unsigned __int8)RtlEqualUnicodeString(&VfTmName, &DataTableEntry->BaseDllName, 1u) == 1 )
  {
    VfTmDllBase = (__int64)DataTableEntry->DllBase;
    VfTmSizeOfImage = DataTableEntry->SizeOfImage;
  }
  else if( (unsigned __int8)RtlEqualUnicodeString(&VfWin32kName, &DataTableEntry->BaseDllName, 1u) == 1 )
  {
    VfWin32kDllBase = (__int64)DataTableEntry->DllBase;
    VfWin32kSizeOfImage = DataTableEntry->SizeOfImage;
  }
  else if( (unsigned __int8)RtlEqualUnicodeString(&VfKsName, &DataTableEntry->BaseDllName, 1u) == 1 )
  {
    VfKsDllBase = (__int64)DataTableEntry->DllBase;
    VfKsSizeOfImage = DataTableEntry->SizeOfImage;
  }
  if( v4 || (v8 = VfThunkApplyMandatoryThunks(DataTableEntry, AlreadyRunninga)) != 0 )
  {
    if( Verifier )
    {
LABEL_45:
      v12 = 1;
LABEL_46:
      if( AlreadyRunninga )
      {
        if( v12 )
          v16 = VfTargetDriversEnableVerifier(DataTableEntry->DllBase, Verifier);
        else
          v16 = 1;
      }
      else
      {
        LOBYTE(v11) = v5;
        v16 = VfTargetDriversAdd(DataTableEntry->DllBase, DataTableEntry->SizeOfImage, v11);
      }
      if( v12 || (v8 = 0, (_DWORD)KernelVerifier) )
      {
        v8 = 0;
        if( v16 )
        {
          v8 = VfThunkApplyThunks(DataTableEntry, AlreadyRunninga);
          if( v8 )
          {
            if( v12 )
            {
              VfUtilPrintCheckinString(&DataTableEntry->BaseDllName);
              ++dword_140C2A650;
              ++Verifier->Loads;
              VfNotifyVerifierExtensions(XdvLoadImageEvent, DataTableEntry);
              VfCheckImageCompliance(DataTableEntry);
            }
          }
          else
          {
            VfTargetDriversRemove(DataTableEntry);
          }
        }
      }
      goto LABEL_58;
    }
    Verifier = VfSuspectDriversList;
    v12 = 0;
    while( Verifier != (_VF_SUSPECT_DRIVER_ENTRY *)&VfSuspectDriversList )
    {
      v13 = (unsigned __int8)RtlEqualUnicodeString(&Verifier->BaseName, &DataTableEntry->BaseDllName, 1u);
      v12 = v13;
      if( v13 )
        goto LABEL_46;
      Verifier = (_VF_SUSPECT_DRIVER_ENTRY *)Verifier->Links.Flink;
    }
    if( (_DWORD)KernelVerifier )
    {
      if( !v4 )
      {
        v14 = ViForceAllDriversSuspect;
        goto LABEL_42;
      }
    }
    else if( (_DWORD)ViVerifyAllDrivers != 1 )
    {
      if( !VfRandomVerifiedDrivers
        || (++ViLoadedDriversCount, !_bittest((const signed __int32 *)qword_140D491F8, ViLoadedDriversCount)) )
      {
        v14 = 0;
LABEL_42:
        if( !v14 )
        {
          Verifier = 0i64;
          goto LABEL_46;
        }
        goto LABEL_38;
      }
      --VfRandomVerifiedDrivers;
    }
LABEL_38:
    Verifier = VfSuspectDriversAllocateEntry(&DataTableEntry->BaseDllName);
    if( !Verifier )
      goto LABEL_46;
    v15 = (_LIST_ENTRY *)qword_140C1D0B8;
    if( *(_VF_SUSPECT_DRIVER_ENTRY ***)qword_140C1D0B8 != &VfSuspectDriversList )
      __fastfail(3u);
    Verifier->Links.Flink = (_LIST_ENTRY *)&VfSuspectDriversList;
    Verifier->Links.Blink = v15;
    v15->Flink = &Verifier->Links;
    qword_140C1D0B8 = (__int64)Verifier;
    goto LABEL_45;
  }
LABEL_58:
  ViDriversLoadLockOwner = 0i64;
  KeReleaseMutex(&ViDriversLoadLock, 0);
  if( v8 )
    DataTableEntry->Flags |= 0x2000000u;
}

Referenced by: