VfKeCheckForChanges

VOID __stdcall VfKeCheckForChanges(UINT64 NewFlags){
  __int16 v1; 
  VOID *PoolWithTagPriority; 
  void *v3; 
  VOID *v4; 
  void *v5; 
  v1 = NewFlags;
  if( (MmVerifierData & 0xFBF) != 0 )
  {
    if( !ViTrackIrqlQueue && ((NewFlags & 2) != 0 || VfVerifyMode >= 3) )
    {
      PoolWithTagPriority = ExAllocatePoolWithTagPriority(
                              NonPagedPoolNx,
                              56i64 * (unsigned int)ViTrackIrqlQueueLength,
                              0x6C717249ui64,
                              HighPoolPriority);
      v3 = PoolWithTagPriority;
      if( PoolWithTagPriority )
      {
        memset((INT64)PoolWithTagPriority, 0i64);
        if( _InterlockedCompareExchange64((volatile signed __int64 *)&ViTrackIrqlQueue, (signed __int64)v3, 0i64) )
          ExFreePoolWithTag(v3, 0);
      }
    }
    if( !VfKeCriticalRegionTraces && (v1 & 0x800) != 0 )
    {
      v4 = ExAllocatePoolWithTagPriority(
             NonPagedPoolNx,
             (unsigned __int64)(unsigned int)VfKeCriticalRegionTracesLength << 6,
             0x52436656ui64,
             (_EX_POOL_PRIORITY)(VfKeCriticalRegionTraces + 32));
      v5 = v4;
      if( v4 )
      {
        memset((INT64)v4, 0i64);
        if( _InterlockedCompareExchange64(&VfKeCriticalRegionTraces, (signed __int64)v5, 0i64) )
          ExFreePoolWithTag(v5, 0);
      }
    }
  }
}

Referenced by: