PfpParametersWatcher

VOID __stdcall PfpParametersWatcher(_PFP_SUPERFETCH_PARAMETERS *SuperfetchParameters){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *v3; 
  __int64 v4; 
  NTSTATUS v5; 
  __int64 v6; 
  char v7; 
  UINT64 CompletionFilter; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *KeyHandle; 

  KeyHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v3 = (_EX_PUSH_LOCK *)(SuperfetchParameters + 126);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)SuperfetchParameters + 63, 0i64);
  v4 = *((_QWORD *)SuperfetchParameters + 1);
  if( v4 )
  {
    v5 = ZwNotifyChangeKey(
           v4,
           0,
           (PIO_APC_ROUTINE)(SuperfetchParameters + 8),
           (PVOID)1,
           (PIO_STATUS_BLOCK)SuperfetchParameters + 1,
           0x1000000Fu,
           0,
           SuperfetchParameters + 16,
           4u,
           1u);
    if( v5 >= 0 )
      goto LABEL_8;
    if( v5 == -1073741444 )
    {
      RtlInitUnicodeString(
        &DestinationString,
        L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management\\PrefetchParameters");
      LODWORD(CompletionFilter) = 0;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Length = 48;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      ObjectAttributes.Attributes = 576;
      if( ZwCreateKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, CompletionFilter, 0i64) >= 0 )
      {
        v6 = *((_QWORD *)SuperfetchParameters + 1);
        *((_QWORD *)SuperfetchParameters + 1) = KeyHandle;
        if( v6 )
          ZwClose(v6);
        if( ZwNotifyChangeKey(
               *((_QWORD *)SuperfetchParameters + 1),
               0,
               (PIO_APC_ROUTINE)(SuperfetchParameters + 8),
               (PVOID)1,
               (PIO_STATUS_BLOCK)SuperfetchParameters + 1,
               0x1000000Fu,
               0,
               SuperfetchParameters + 16,
               4u,
               1u) >= 0 )
        {
LABEL_8:
          v7 = 0;
          if( PfpParametersRead(SuperfetchParameters) >= 0 )
          {
            PfpParametersPropagate(SuperfetchParameters);
            v7 = 1;
          }
          if( PfSnParametersRead(SuperfetchParameters) >= 0 )
          {
            PfSnDetermineEnablePrefetcher();
            v7 = 1;
          }
          if( v7 && *(_QWORD *)SuperfetchParameters )
            KeSetEvent(*(PRKEVENT *)SuperfetchParameters, 0, 0);
        }
      }
    }
  }
  if( (_InterlockedExchangeAdd64(&v3->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v3);
  KeAbPostRelease(v3);
  KeLeaveCriticalRegion();
}

Referenced by: