PfpPrefetchDirectoryStream
NTSTATUS __fastcall PfpPrefetchDirectoryStream(
_PFP_PREFETCH_CONTEXT *PrefetchContext,
INT64 a2,
INT64 a3,
INT64 a4,
INT64 a5,
INT64 a6){
__int64 v6;
UINT64 InputBufferLength;
__int64 v10;
unsigned __int64 v11;
unsigned int v12;
__int64 v13;
NTSTATUS v14;
unsigned int v15;
unsigned int v16;
unsigned int v17;
__int64 v18;
unsigned __int64 v19;
unsigned __int64 v20;
unsigned __int64 v21;
UINT64 IoControlCode;
__int64 v24;
UINT64 v25[2];
VOID *Handle;
__int128 v27;
__int64 v28;
unsigned int SublistMax;
v6 = *((_QWORD *)PrefetchContext + 5);
InputBufferLength = *((_QWORD *)PrefetchContext + 3);
*(_OWORD *)v25 = 0i64;
v28 = 0x200000000i64;
v10 = *(_QWORD *)PrefetchContext;
v11 = 0i64;
v24 = v6;
Handle = 0i64;
v12 = *(unsigned __int16 *)(v10 + 30);
*(_DWORD *)InputBufferLength = 4;
v13 = *(_QWORD *)PrefetchContext;
SublistMax = v12;
v27 = 0i64;
*(_QWORD *)(InputBufferLength + 8) = (8 * (v12 & 7)) | (unsigned __int64)(*(_DWORD *)(v13 + 28) & 7);
v14 = PfpOpenHandleCreate((__int64)&Handle, v6, *(_QWORD *)(a5 + 16), *(_QWORD *)(a5 + 8), 1048577, a6, 0, a2);
if( v14 >= 0 )
{
if( (*(_DWORD *)(*(_QWORD *)PrefetchContext + 80i64) & 4) != 0 )
MmQueryMemoryListInformation((VOID *)0xFFFFFFFFFFFFFFFFi64, (UINT64)(PrefetchContext + 12), (UINT64 *)0xB0);
v15 = 0;
while( v15 < *(_DWORD *)(a3 + 16) )
{
*(_DWORD *)(InputBufferLength + 4) = 0;
if( v15 >= *(_DWORD *)(a3 + 16) )
break;
v16 = PrefetchContext[8];
v17 = 0;
do
{
v18 = *(_QWORD *)(a3 + 24);
v19 = *(_QWORD *)(v18 + 16i64 * v15);
v20 = v11;
v21 = v19 + *(unsigned int *)(v18 + 16i64 * v15 + 8);
if( v19 >= v11 )
v20 = *(_QWORD *)(v18 + 16i64 * v15);
while( v20 < v21 )
{
*(_QWORD *)(InputBufferLength + 8i64 * *(unsigned int *)(InputBufferLength + 4) + 16) = v20;
v20 += 4096i64;
v17 = *(_DWORD *)(InputBufferLength + 4) + 1;
*(_DWORD *)(InputBufferLength + 4) = v17;
v16 = PrefetchContext[8];
if( v17 >= v16 )
{
v11 = v20;
break;
}
}
if( v17 >= v16 )
break;
++v15;
}
while( v15 < *(_DWORD *)(a3 + 16) );
if( !v17 )
break;
if( (unsigned int)PfpCheckPrefetchAbort(PrefetchContext)
|| (*(_DWORD *)(*(_QWORD *)PrefetchContext + 80i64) & 4) != 0
&& *((_QWORD *)PrefetchContext + 6)
+ *((_QWORD *)PrefetchContext + 7)
+ PfpGetPageListCount((UINT64 *)PrefetchContext + 11, 0i64, SublistMax) < 0x80 )
{
v14 = -1073741248;
goto LABEL_24;
}
LODWORD(IoControlCode) = 590112;
v14 = IopXxxControlFile(Handle, 0i64, 0i64, 0i64, v25, IoControlCode, InputBufferLength);
if( (*(_DWORD *)(*(_QWORD *)PrefetchContext + 80i64) & 4) != 0 )
PfpUpdateRepurposedByPrefetch((__int64)(PrefetchContext + 12), *(unsigned int *)(InputBufferLength + 4));
if( v14 < 0 )
{
if( v14 == -1073741807 )
break;
goto LABEL_24;
}
if( v14 == 259 )
KeBugCheckEx(0x191u, (PVOID)0x14BC, 0i64, 0i64, 0i64);
}
v14 = 0;
LABEL_24:
v6 = v24;
}
if( (v28 & 0x400000000i64) != 0 )
PfpOpenHandleClose(&Handle, v6);
return v14;
}Referenced by:
PfpVolumePrefetchMetadata