VfBeforeCallDriver

__int64 __fastcall VfBeforeCallDriver(__int64 a1, ULONG_PTR a2, __int64 a3){
  ULONG_PTR v7; 
  unsigned int v8; 
  UINT64 v9; 
  char v10; 
  char v11; 
  __int64 v12; 
  __int64 v13; 
  if( *(_BYTE *)(a2 + 64) != 1 && (MmVerifierData & 0x100) != 0 && !*(_QWORD *)(a2 + 8) )
  {
    if( (*(_DWORD *)(a2 + 16) & 0x10) != 0 )
      v7 = *(_QWORD *)(a2 + 24);
    else
      v7 = *(_QWORD *)(a2 + 112);
    ViIrpCheckKernelAddressForIrp(a2, v7, a3);
  }
  if( a3 )
  {
    KeAreInterruptsEnabled(a1, (_BYTE *)a2);
    if( !v10 && (MmVerifierData & 0x400000) == 0 )
    {
      KeAcquireSpinLockRaiseToDpc(&VfBugcheckTmpDataLock, v9);
      *(_BYTE *)(a3 + 157) = v11;
      *(_OWORD *)&xmmword_140D49040 = 0i64;
      *(_QWORD *)&VfBugcheckTmpData = 196i64;
      BugCheckParameter1 = 192i64;
      qword_140D49038 = a2;
      VfBugCheckNoStackUsage();
    }
    LODWORD(v12) = VfGetPristineDispatchRoutine(
                     *(DRIVER_OBJECT **)(a1 + 8),
                     *(unsigned __int8 *)(*(_QWORD *)(a2 + 184) - 72i64));
    *(_QWORD *)(a3 + 48) = v12;
    LOBYTE(v12) = KeGetCurrentIrql();
    *(_BYTE *)(a3 + 156) = v12;
    *(_DWORD *)(a3 + 188) = *((_DWORD *)KeGetCurrentThread() + 121);
    if( *(char *)(a2 + 67) == *(char *)(a2 + 66) + 1 )
    {
      v13 = *(_QWORD *)(a2 + 80);
      if( v13 )
      {
        if( !*(_BYTE *)(a2 + 64) && *(_DWORD *)(v13 + 4) )
          *(_DWORD *)(a3 + 152) |= 2u;
      }
    }
    v8 = VfDeadlockBeforeCallDriver((_IRP *)a2);
    if( !VfIoDisabled )
    {
      *(_DWORD *)(a3 + 152) |= 1u;
      IovpCallDriver1(a3);
    }
  }
  else
  {
    return(unsigned int)VfDeadlockBeforeCallDriver((_IRP *)a2);
  }
  return v8;
}

Referenced by: