VfCheckImageCompliance

VOID __stdcall VfCheckImageCompliance(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  int v2; 
  __int64 v3; 
  __int64 v4; 
  __int64 Param3; 
  unsigned int *v6; 
  unsigned int v7; 
  unsigned int v8; 
  __int16 v9; 
  int v10; 
  char Str1[8]; 
  char v12; 

  v2 = 1;
  if( (MmVerifierData & 0x2000000) != 0 )
  {
    LODWORD(v3) = RtlImageNtHeader((UINT64)DataTableEntry->DllBase);
    v4 = v3;
    if( v3 )
    {
      Param3 = *(unsigned __int16 *)(v3 + 20) + v3 + 24;
      v6 = (unsigned int *)(v3 + 232);
      if( !*(_DWORD *)(v3 + 232) || !*(_DWORD *)(v3 + 236) )
        v2 = 0;
      v7 = 0;
      if( *(_WORD *)(v3 + 6) )
      {
        do
        {
          if( (*(_DWORD *)(Param3 + 36) & 0xA0000000) == -1610612736 )
          {
            *(_QWORD *)Str1 = *(_QWORD *)Param3;
            v12 = 0;
            if( stricmp(Str1, "INIT") || (VfOptionFlags & 0x100) != 0 )
            {
              ViCiPreprocessOptions(
                &unk_140C12C8C,
                (CHAR *)"The image %wZ contains an executable and writable section 0x%p(name %s).",
                0x2003ui64,
                (UINT64)&DataTableEntry->BaseDllName,
                Param3,
                (UINT64)Str1,
                *(UINT64 *)Str1);
              VfReportIssueWithOptions(
                0xC4ui64,
                0x2003u,
                (_DWORD)DataTableEntry + 88,
                Param3,
                (ULONG_PTR)Str1,
                &unk_140C12C8C);
              if( (MmVerifierData & 0x1000) != 0 )
                ViTargetIncrementCounter(DataTableEntry->EntryPoint, 0x11Cui64);
              _InterlockedIncrement(&dword_140C2A6BC);
            }
          }
          if( v2 )
          {
            v8 = *(_DWORD *)(Param3 + 12);
            if( v8 <= *v6 && *(_DWORD *)(Param3 + 8) + v8 > *v6 && (*(_DWORD *)(Param3 + 36) & 0x20000000) != 0 )
            {
              *(_QWORD *)Str1 = *(_QWORD *)Param3;
              v12 = 0;
              ViCiPreprocessOptions(
                (UINT64 *)((char *)&qword_140C12C84 + 4),
                (CHAR *)"The image %wZ contains an IAT, 0x%p in executable section(name %s).",
                0x2005ui64,
                (UINT64)&DataTableEntry->BaseDllName,
                (UINT64)v6,
                (UINT64)Str1,
                *(UINT64 *)Str1);
              VfReportIssueWithOptions(
                0xC4ui64,
                0x2005u,
                (_DWORD)DataTableEntry + 88,
                (ULONG_PTR)v6,
                (ULONG_PTR)Str1,
                (UINT64 *)((char *)&qword_140C12C84 + 4));
              if( (MmVerifierData & 0x1000) != 0 )
                ViTargetIncrementCounter(DataTableEntry->EntryPoint, 0x124ui64);
              _InterlockedIncrement(&dword_140C2A6C4);
            }
          }
          v9 = *(_WORD *)(v4 + 24);
          if( v9 == 267 || v9 == 523 )
            v10 = *(_DWORD *)(v4 + 56);
          else
            v10 = 4096;
          if( !v10 || (v10 & 0xFFF) != 0 )
          {
            *(_QWORD *)Str1 = *(_QWORD *)Param3;
            v12 = 0;
            ViCiPreprocessOptions(
              &qword_140C12C7C,
              (CHAR *)"The image %wZ contains section 0x%p that is not page aligned(name %s).",
              0x2004ui64,
              (UINT64)&DataTableEntry->BaseDllName,
              Param3,
              (UINT64)Str1,
              *(UINT64 *)Str1);
            VfReportIssueWithOptions(
              0xC4ui64,
              0x2004u,
              (_DWORD)DataTableEntry + 88,
              Param3,
              (ULONG_PTR)Str1,
              &qword_140C12C7C);
            if( (MmVerifierData & 0x1000) != 0 )
              ViTargetIncrementCounter(DataTableEntry->EntryPoint, 0x120ui64);
            _InterlockedIncrement(&dword_140C2A6C0);
          }
          Param3 += 40i64;
          ++v7;
        }
        while( v7 < *(unsigned __int16 *)(v4 + 6) );
      }
    }
  }
}

Referenced by: