ViFilterDeviceUsageNotificationCompletion

INT64 __stdcall ViFilterDeviceUsageNotificationCompletion(_DEVICE_OBJECT *DeviceObject, _IRP *Irp, PVOID Context){
  __int64 v5; 
  __int64 v6; 
  unsigned __int8 v7; 
  unsigned __int64 v8; 
  int v9; 
  int v10; 
  __int64 v11; 
  if( *((_BYTE *)Irp + 65) )
    *(_BYTE *)(*((_QWORD *)Irp + 23) + 3i64) |= 1u;
  v5 = *((_QWORD *)DeviceObject + 8);
  if( *((int *)Irp + 12) >= 0 )
  {
    v6 = *((_QWORD *)Irp + 23);
    KeAcquireSpinLockRaiseToDpc((UINT64 *)(v5 + 88), (UINT64)Irp);
    v8 = v7;
    v9 = *(_DWORD *)(v5 + 96);
    if( *(_BYTE *)(v6 + 8) )
    {
      *(_DWORD *)(v5 + 96) = v9 + 1;
      if( !v9 )
        *((_DWORD *)DeviceObject + 12) &= ~0x2000u;
    }
    else
    {
      v10 = v9 - 1;
      *(_DWORD *)(v5 + 96) = v10;
      if( !v10 )
      {
        v11 = *(_QWORD *)(v5 + 8);
        *((_DWORD *)DeviceObject + 12) |= *(_DWORD *)(v11 + 48) & 0x2000;
      }
    }
    _InterlockedAnd64((volatile signed __int64 *)(v5 + 88), 0i64);
    __writecr8(v8);
  }
  IoReleaseRemoveLockEx((IO_REMOVE_LOCK *)(v5 + 32), Irp, 0x20ui64);
  return 0i64;
}

Referenced by: