ViCtxCheckAndReleaseIsrState

INT64 __fastcall ViCtxCheckAndReleaseIsrState(INT64 a1, const VOID *a2){
  unsigned __int8 CurrentIrql; 
  char v5; 
  INT64 result; 
  UINT64 v7; 
  UINT64 v8; 
  UINT64 Parameter4; 
  CurrentIrql = KeGetCurrentIrql();
  v5 = *(_BYTE *)(a1 + 8);
  *(_BYTE *)(a1 + 9) = CurrentIrql;
  if( v5 != CurrentIrql
    || ((*(_DWORD *)(a1 + 4) & 2) == 0 ? (result = 1i64) : (RtlXSave(*(XSAVE_AREA **)(a1 + 64), ViCtxXStateEnabledMask),
                                                            v5 = *(_BYTE *)(a1 + 8),
                                                            result = ViCtxEqualExtendedState(
                                                                       *(XSAVE_AREA **)(a1 + 32),
                                                                       *(XSAVE_AREA **)(a1 + 64))),
        !(_DWORD)result) )
  {
    if( v5 == *(_BYTE *)(a1 + 9) )
    {
      VfUtilDbgPrint((INT8 *)"Interrupt Service Routine %p has changed extended thread context.\n"
                             "Context saved before executing ISR: 0x%p. Context saved after executing ISR: 0x%p.\n");
      v7 = *(_QWORD *)(a1 + 32);
      v8 = 272i64;
      Parameter4 = *(_QWORD *)(a1 + 64);
    }
    else
    {
      VfUtilDbgPrint((INT8 *)"Interrupt Service Routine %p has changed IRQL.\n"
                             "IRQL before executing ISR: %d. IRQL after executing ISR: %d.\n");
      v7 = *(unsigned __int8 *)(a1 + 8);
      v8 = 273i64;
      Parameter4 = *(unsigned __int8 *)(a1 + 9);
    }
    VfErrorStoreTriageInformation(0xC4ui64, v8, (UINT64)a2, v7, Parameter4);
    NT_ASSERT("
Interrupt Service Routine has changed IRQL.
Please run !analyze for additional information.
");
  }
  *(_DWORD *)(a1 + 4) &= ~2u;
  _InterlockedExchange((volatile __int32 *)a1, 0);
  return result;
}

Referenced by: