VfIrpLogRecordEvent

VOID __stdcall VfIrpLogRecordEvent(UINT64 VerifierSettings, _DEVICE_OBJECT *DeviceObject, _IRP *Irp){
  _WORK_QUEUE_ITEM *PoolWithTag; 
  unsigned __int64 v6; 
  _IRPLOG_DATA *Pointer; 
  _IRPLOG_HEAD *v8; 
  VOID **v9; 
  _QWORD *v10; 
  unsigned int DeviceType; 
  _QWORD *v12; 
  __int64 v13; 
  int v14; 
  unsigned int v15; 
  __int64 v16; 
  _IRPLOG_HEAD *HashHead; 
  __int128 v18; 
  __int128 v19; 
  VOID *v20; 

  HashHead = 0i64;
  v20 = 0i64;
  v18 = 0i64;
  v19 = 0i64;
  if( (VerifierSettings & 0x400) != 0 )
  {
    if( ViIrpLogDdiLock != 2 && !_InterlockedCompareExchange(&ViIrpLogDdiLock, 1, 0) )
    {
      PoolWithTag = (_WORK_QUEUE_ITEM *)ExAllocatePoolWithTag(0x200ui64, 0x20ui64, 2001299030i64);
      if( PoolWithTag )
      {
        PoolWithTag->List.Flink = 0i64;
        PoolWithTag->WorkerRoutine = (void(__fastcall *)(void *))ViIrpLogExposeWmiCallback;
        PoolWithTag->Parameter = PoolWithTag;
        ExQueueWorkItem(PoolWithTag, DelayedWorkQueue);
      }
      else
      {
        ViIrpLogDdiLock = 0;
      }
    }
    v6 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&ViIrpLogDatabaseLock);
    if( (unsigned int)IovUtilIsDeviceObjectMarked(DeviceObject, 0) )
      goto LABEL_21;
    Pointer = ViIrpLogDatabaseFindPointer(DeviceObject, &HashHead);
    v8 = HashHead;
    v9 = (VOID **)Pointer;
    if( *HashHead )
      goto LABEL_21;
    if( !Pointer )
    {
      v9 = ExAllocatePoolWithTag(0x200ui64, 0x348ui64, 1699309142i64);
      if( !v9 )
      {
LABEL_21:
        KxReleaseSpinLock(&ViIrpLogDatabaseLock);
        __writecr8(v6);
        return;
      }
      ObfReferenceObject(DeviceObject);
      *((_DWORD *)v9 + 6) = 0;
      v10 = v8 + 2;
      *v9 = DeviceObject;
      DeviceType = DeviceObject->DeviceType;
      *((_DWORD *)v9 + 9) = 0;
      *((_DWORD *)v9 + 7) = DeviceType;
      v12 = v9 + 1;
      *((_DWORD *)v9 + 8) = 20;
      v13 = *((_QWORD *)v8 + 1);
      if( *(_IRPLOG_HEAD **)(v13 + 8) != v8 + 2 )
        __fastfail(3u);
      *v12 = v13;
      v9[2] = v10;
      *(_QWORD *)(v13 + 8) = v12;
      *v10 = v12;
    }
    v14 = *((_DWORD *)v9 + 6);
    if( (v14 & 6) == 0 )
    {
      if( v14 == 1 )
        v15 = *((_DWORD *)v9 + 8);
      else
        v15 = *((_DWORD *)v9 + 9);
      if( (unsigned int)VfMajorBuildIrpLogEntry(
                           (__int64)Irp,
                           v15,
                           (__int64)&v9[5 * *((unsigned int *)v9 + 9) + 5],
                           (__int64)&v18) )
      {
        v16 = 5 * (*((unsigned int *)v9 + 9) + 1i64);
        *(_OWORD *)&v9[v16] = v18;
        *(_OWORD *)&v9[v16 + 2] = v19;
        v9[v16 + 4] = v20;
        if( ++*((_DWORD *)v9 + 9) == *((_DWORD *)v9 + 8) )
        {
          *((_DWORD *)v9 + 6) |= 1u;
          *((_DWORD *)v9 + 9) = 0;
        }
      }
    }
    goto LABEL_21;
  }
}

Referenced by: