VfFilterAttach

void __fastcall VfFilterAttach(PDEVICE_OBJECT TargetDevice, int a2, WCHAR a3){
  HANDLE v5; 
  LPGUID v6; 
  PDRIVER_OBJECT v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  UNICODE_STRING *v11; 
  PDEVICE_OBJECT v12; 
  __int64 v13; 
  PDEVICE_OBJECT v14; 
  struct _OBJECT_ATTRIBUTES *DeviceCharacteristics; 
  struct _UNICODE_STRING DestinationString; 
  PDEVICE_OBJECT SourceDevice; 
  DestinationString = 0i64;
  SourceDevice = 0i64;
  if( !VfFilterCreated )
  {
    RtlInitUnicodeString(&DestinationString, L"\\DRIVER\\VERIFIER_FILTER", a3);
    IoCreateDriver((PHANDLE)&DestinationString, (ACCESS_MASK)ViFilterDriverEntry, v5, v6, DeviceCharacteristics);
    VfFilterCreated = 1;
  }
  v7 = VfFilterDriverObject;
  if( VfFilterDriverObject && a2 >= 2 && (a2 <= 3 || (unsigned int)(a2 - 5) <= 1) )
  {
    IoGetAttachedDevice(TargetDevice);
    v9 = v8;
    if( *(PDRIVER_OBJECT *)(v8 + 8) != v7 )
    {
      if( !(unsigned __int8)HviIsAnyHypervisorPresent()
        || (v10 = *(_QWORD *)(*(_QWORD *)(v9 + 8) + 40i64)) == 0
        || (v11 = (UNICODE_STRING *)(v10 + 88), !RtlEqualUnicodeString((UNICODE_STRING *)&VfVidName, v11, 1u))
        && !RtlEqualUnicodeString((UNICODE_STRING *)&VfSynth3DvscName, v11, 1u)
        && !RtlEqualUnicodeString((UNICODE_STRING *)&VfSynth3DvspName, v11, 1u) )
      {
        LODWORD(DeviceCharacteristics) = 256;
        if( IoCreateDevice(
               VfFilterDriverObject,
               0x68ui64,
               0i64,
               0x22ui64,
               (UINT64)DeviceCharacteristics,
               0,
               &SourceDevice) >= 0 )
        {
          v12 = SourceDevice;
          v13 = *((_QWORD *)SourceDevice + 8);
          IoInitializeRemoveLockEx(v13 + 32, 0x4C526656u, 0, 0);
          *(_QWORD *)(v13 + 88) = 0i64;
          v14 = IoAttachDeviceToDeviceStack(v12, TargetDevice);
          *(_QWORD *)(v13 + 8) = v14;
          if( v14 )
          {
            *((_DWORD *)v12 + 12) |= *((_DWORD *)v14 + 12) & 0x86014;
            *((_DWORD *)v12 + 18) = *(_DWORD *)(*(_QWORD *)(v13 + 8) + 72i64);
            *((_DWORD *)v12 + 13) = *(_DWORD *)(*(_QWORD *)(v13 + 8) + 52i64);
            *((_DWORD *)v12 + 12) &= ~0x80u;
            *(_QWORD *)(v13 + 16) = v12;
            *(_QWORD *)v13 = TargetDevice;
            _InterlockedOr((volatile signed __int32 *)(v13 + 100), 1u);
          }
          else
          {
            IoDeleteDevice(v12);
          }
        }
      }
    }
  }
}

Referenced by: