VfBeforeCallDriver

NTSTATUS __stdcall VfBeforeCallDriver(
        _DEVICE_OBJECT *DeviceObject,
        ULONG_PTR Irp,
        _IOFCALLDRIVER_STACKDATA *CallDriverData){
  _IRP *v4; 
  _IRP *v6; 
  VOID *v7; 
  NTSTATUS v8; 
  char v9; 
  __int64 v10; 
  _KEVENT *UserEvent; 

  v4 = *(_IRP **)&Irp;
  if( *(_BYTE *)(*(_QWORD *)&Irp + 64i64) != 1 && (MmVerifierData & 0x100) != 0 && !*(_QWORD *)(*(_QWORD *)&Irp + 8i64) )
  {
    v6 = *(_IRP **)&Irp;
    if( (*(_DWORD *)(*(_QWORD *)&Irp + 16i64) & 0x10) != 0 )
      v7 = *(VOID **)(*(_QWORD *)&Irp + 24i64);
    else
      v7 = *(VOID **)(*(_QWORD *)&Irp + 112i64);
    ViIrpCheckKernelAddressForIrp(v6, v7, CallDriverData);
  }
  if( !CallDriverData )
    return VfDeadlockBeforeCallDriver(v4);
  KeAreInterruptsEnabled((CHAR)DeviceObject, *(_BYTE **)&Irp);
  if( !v9 && (MmVerifierData & 0x400000) == 0 )
  {
    *((_BYTE *)CallDriverData + 157) = KeAcquireSpinLockRaiseToDpc(&VfBugcheckTmpDataLock);
    *(_OWORD *)&xmmword_140D49040 = 0i64;
    *(_QWORD *)&VfBugcheckTmpData = 196i64;
    BugCheckParameter1 = (PVOID)192;
    qword_140D49038 = v4;
    VfBugCheckNoStackUsage();
  }
  LODWORD(v10) = VfGetPristineDispatchRoutine(
                   DeviceObject->DriverObject,
                   v4->Tail.CurrentStackLocation[-1].MajorFunction);
  *((_QWORD *)CallDriverData + 6) = v10;
  LOBYTE(v10) = KeGetCurrentIrql();
  *((_BYTE *)CallDriverData + 156) = v10;
  CallDriverData[47] = KeGetCurrentThread()->WaitBlock[3].SpareLong;
  if( v4->CurrentLocation == v4->StackCount + 1 )
  {
    UserEvent = v4->UserEvent;
    if( UserEvent )
    {
      if( !v4->RequestorMode && *((_DWORD *)UserEvent + 1) )
        CallDriverData[38] |= 2u;
    }
  }
  v8 = VfDeadlockBeforeCallDriver(v4);
  if( !VfIoDisabled )
  {
    CallDriverData[38] |= 1u;
    IovpCallDriver1(CallDriverData);
  }
  return v8;
}

Referenced by: