TRF7970A: how raw write works

Hi,

I am ckecking sloc297c example code. I mostly understood how trf7970a works. I could not understand is spi raw write to the ic.

uint8_t ISO14443A_sendPollCmd(uint8_t cmd)
{
    uint8_t offset = 0;
    uint8_t status = STATUS_FAIL;

    g_pui8TrfBuffer[offset++] = 0x8F; // Reset FIFO
    g_pui8TrfBuffer[offset++] = 0x90; // Send without CRC
    g_pui8TrfBuffer[offset++] = 0x3D; // Write Continuous
    g_pui8TrfBuffer[offset++] = 0x00; // Length of packet in bytes - upper and middle nibbles of transmit byte length
    g_pui8TrfBuffer[offset++] = 0x0F; // Length of packet in bytes - lower and broken nibbles of transmit byte length
    g_pui8TrfBuffer[offset++] = cmd;  // Send the polling command from function input - either REQA (0x26) or WUPA (0x52)

    // Issue the ISO14443A Polling Command
    TRF79xxA_writeRaw(g_pui8TrfBuffer, offset);

    g_sTrfStatus = TRF79xxA_waitRxData(3, 10); // 3 millisecond TX timeout, 10 millisecond RX timeout

    if (g_sTrfStatus == RX_COMPLETE) // Tag detected - could be either a single or collided tag
    {
        status = STATUS_SUCCESS;
    }
    else if (g_sTrfStatus == COLLISION_ERROR)
    {
        status = STATUS_SUCCESS; // "A PCD detecting a collision in any bit of (b16 to b1) shall commence with the first step of the anticollision loop."
    }

    return status;
}

The function above sends REQ command to the picc. But before REQ cmd, there are 5 additional  bytes. Register address is not specified while this data is written. How trf processes this data. For example first data is 0x8F which resets fifo and it seems like it is a command but we do not specify a register for this process. Could you explain or provide any resource to help me understand it?

Best regards.