VfKeCheckForChanges

VOID __stdcall VfKeCheckForChanges(UINT64 NewFlags){
  __int16 v1; 
  size_t v2; 
  VOID *PoolWithTagPriority; 
  void *v4; 
  size_t v5; 
  VOID *v6; 
  void *v7; 

  v1 = NewFlags;
  if( (MmVerifierData & 0xFBF) != 0 )
  {
    if( !ViTrackIrqlQueue && ((NewFlags & 2) != 0 || VfVerifyMode >= 3) )
    {
      v2 = 56 * ViTrackIrqlQueueLength;
      PoolWithTagPriority = ExAllocatePoolWithTagPriority(
                              NonPagedPoolNx,
                              56i64 * (unsigned int)ViTrackIrqlQueueLength,
                              0x6C717249ui64,
                              HighPoolPriority);
      v4 = PoolWithTagPriority;
      if( PoolWithTagPriority )
      {
        memset(PoolWithTagPriority, 0i64, v2);
        if( _InterlockedCompareExchange64((volatile signed __int64 *)&ViTrackIrqlQueue, (signed __int64)v4, 0i64) )
          ExFreePoolWithTag(v4, 0);
      }
    }
    if( !VfKeCriticalRegionTraces && (v1 & 0x800) != 0 )
    {
      v5 = VfKeCriticalRegionTracesLength << 6;
      v6 = ExAllocatePoolWithTagPriority(
             NonPagedPoolNx,
             (unsigned __int64)(unsigned int)VfKeCriticalRegionTracesLength << 6,
             0x52436656ui64,
             (_EX_POOL_PRIORITY)(VfKeCriticalRegionTraces + 32));
      v7 = v6;
      if( v6 )
      {
        memset(v6, 0i64, v5);
        if( _InterlockedCompareExchange64(&VfKeCriticalRegionTraces, (signed __int64)v7, 0i64) )
          ExFreePoolWithTag(v7, 0);
      }
    }
  }
}

Referenced by: