VfFilterAttach

VOID __stdcall VfFilterAttach(PDEVICE_OBJECT PhysicalDeviceObject, VF_DEVOBJ_TYPE DeviceObjectType){
  PDRIVER_OBJECT v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  const _UNICODE_STRING *v8; 
  PDEVICE_OBJECT v9; 
  char *DeviceExtension; 
  PDEVICE_OBJECT *v11; 
  _OBJECT_ATTRIBUTES *DeviceCharacteristics; 
  _UNICODE_STRING DestinationString; 
  PDEVICE_OBJECT SourceDevice; 

  DestinationString = 0i64;
  SourceDevice = 0i64;
  if( !VfFilterCreated )
  {
    RtlInitUnicodeString(&DestinationString, L"\\DRIVER\\VERIFIER_FILTER");
    IoCreateDriver((OWORD *)&DestinationString.Length, (UINT64)ViFilterDriverEntry);
    VfFilterCreated = 1;
  }
  v4 = VfFilterDriverObject;
  if( VfFilterDriverObject
    && DeviceObjectType >= VF_DEVOBJ_LOWER_DEVICE_FILTER
    && (DeviceObjectType <= VF_DEVOBJ_LOWER_CLASS_FILTER || (unsigned int)(DeviceObjectType - 5) <= 1) )
  {
    LODWORD(v5) = IoGetAttachedDevice((INT64)PhysicalDeviceObject);
    v6 = v5;
    if( *(PDRIVER_OBJECT *)(v5 + 8) != v4 )
    {
      if( !HviIsAnyHypervisorPresent()
        || (v7 = *(_QWORD *)(*(_QWORD *)(v6 + 8) + 40i64)) == 0
        || (v8 = (const _UNICODE_STRING *)(v7 + 88), !(unsigned __int8)RtlEqualUnicodeString(&VfVidName, v8, 1u))
        && !(unsigned __int8)RtlEqualUnicodeString(&VfSynth3DvscName, v8, 1u)
        && !(unsigned __int8)RtlEqualUnicodeString(&VfSynth3DvspName, v8, 1u) )
      {
        LODWORD(DeviceCharacteristics) = 256;
        if( IoCreateDevice(
               VfFilterDriverObject,
               0x68ui64,
               0i64,
               0x22ui64,
               (UINT64)DeviceCharacteristics,
               0,
               &SourceDevice) >= 0 )
        {
          v9 = SourceDevice;
          DeviceExtension = (char *)SourceDevice->DeviceExtension;
          IoInitializeRemoveLockEx((PIO_REMOVE_LOCK)(DeviceExtension + 32), 0x4C526656u, 0, 0, 0x20u);
          *((_QWORD *)DeviceExtension + 11) = 0i64;
          v11 = IoAttachDeviceToDeviceStack(v9, PhysicalDeviceObject);
          *((_QWORD *)DeviceExtension + 1) = v11;
          if( v11 )
          {
            v9->Flags |= (_DWORD)v11[6] & 0x86014;
            v9->DeviceType = *(_DWORD *)(*((_QWORD *)DeviceExtension + 1) + 72i64);
            v9->Characteristics = *(_DWORD *)(*((_QWORD *)DeviceExtension + 1) + 52i64);
            v9->Flags &= ~0x80u;
            *((_QWORD *)DeviceExtension + 2) = v9;
            *(_QWORD *)DeviceExtension = PhysicalDeviceObject;
            _InterlockedOr((volatile signed __int32 *)DeviceExtension + 25, 1u);
          }
          else
          {
            IoDeleteDevice(v9);
          }
        }
      }
    }
  }
}

Referenced by: