PfSnOpenVolumesForPrefetch
INT64 __fastcall PfSnOpenVolumesForPrefetch(INT64 *rcx0, INT64 rdx0, EVENT_DESCRIPTOR *r8){
INT64 v3;
WCHAR *v5;
int v6;
EVENT_DESCRIPTOR *v7;
unsigned int v8;
VOID *PoolWithTag;
unsigned int i;
INT64 v11;
NTSTATUS v12;
int v13;
bool v14;
unsigned int v15;
wchar_t *v16;
__int64 v17;
int IsVolumeMounted;
UINT v19;
VOID *v20;
__int64 v21;
int v22;
__int128 v23;
PVOID v24;
_QWORD *v25;
WCHAR *v26;
__int64 v27;
__int64 v28;
INT64 v29;
unsigned int *v30;
PVOID *v31;
INT64 v32;
PVOID *v33;
WCHAR *v34;
__int64 v35;
__int64 v36;
__int64 v37;
__int128 v38;
__int128 v39;
INT64 **v40;
void *v41;
_QWORD *v42;
__int64 v43;
INT64 **v45;
PVOID P;
PVOID *p_P;
int v48;
PCWSTR SourceString;
PVOID a2;
void *EventHandle;
__int128 v52;
__m256i v53;
__m256i a1;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
UINT VolumeMounted;
_DWORD *v57;
size_t cbDest;
__int64 RemovableMedia;
v57 = (_DWORD *)rdx0;
v3 = *rcx0;
p_P = &P;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
P = &P;
a2 = 0i64;
a1.m256i_i64[3] = 0x200000000i64;
v53.m256i_i64[3] = 0x200000000i64;
v52 = 0i64;
v48 = 0;
v5 = 0i64;
VolumeMounted = 0;
v6 = 0;
LODWORD(RemovableMedia) = 0;
SourceString = 0i64;
memset(&a1, 0, 24);
memset(&v53, 0, 24);
EventHandle = 0i64;
PfSnLogOpenVolumesForPrefetch(v3, 1, r8);
if( v3 && (v8 = *(_DWORD *)(v3 + 112), v8 < 0x4000) )
{
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 112 * v8, 0x76506343ui64);
rcx0[2] = (INT64)PoolWithTag;
if( !PoolWithTag )
goto LABEL_56;
for( i = 0; i < *(_DWORD *)(v3 + 112); *(_QWORD *)(v11 + 88) |= 0x200000000ui64 )
{
v11 = rcx0[2] + 112i64 * i;
memset(v11, 0i64);
*(_QWORD *)(v11 + 8) = v11;
*(_QWORD *)v11 = v11;
++i;
*(_OWORD *)(v11 + 32) = 0i64;
*(_OWORD *)(v11 + 48) = 0i64;
*(_QWORD *)(v11 + 56) |= 0x200000000ui64;
*(_OWORD *)(v11 + 64) = 0i64;
*(_OWORD *)(v11 + 80) = 0i64;
}
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 512;
ObjectAttributes.ObjectName = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v12 = NtCreateEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes, NotificationEvent, 0);
if( v12 < 0 )
goto LABEL_40;
IopGetDeviceInterfaces(&GUID_DEVINTERFACE_VOLUME, 0i64, 0i64, 0, (WCHAR **)&SourceString, 0i64);
v5 = (WCHAR *)SourceString;
v12 = v13;
if( v13 < 0 )
goto LABEL_40;
v14 = *SourceString == 0;
v15 = 0;
LODWORD(cbDest) = 0;
v16 = (wchar_t *)SourceString;
while( !v14 )
{
v17 = -1i64;
do
++v17;
while( v16[v17] );
SourceString = (PCWSTR)(2i64 * (unsigned int)(v17 + 1));
if( v15 <= (unsigned __int64)SourceString )
LODWORD(cbDest) = 2 * v17 + 2;
IsVolumeMounted = PfSnIsVolumeMounted(v16, &VolumeMounted, (UINT *)&RemovableMedia);
v19 = VolumeMounted;
if( IsVolumeMounted < 0 )
v19 = 0;
VolumeMounted = v19;
if( v19 && !(_DWORD)RemovableMedia && (int)PfSnQueryVolumeInfo(rcx0[1], v16, &a1, &a2, &v48) >= 0 )
{
v20 = ExAllocatePoolWithTag(PagedPool, 0x48ui64, 0x76506343ui64);
v21 = (__int64)v20;
if( !v20 )
goto LABEL_56;
memset((INT64)v20, 0i64);
v22 = v48;
v23 = *(_OWORD *)&a1.m256i_u64[2];
v24 = a2;
*(_OWORD *)(v21 + 16) = *(_OWORD *)a1.m256i_i8;
*(_DWORD *)(v21 + 60) = v22;
*(_QWORD *)(v21 + 64) = v24;
*(_OWORD *)(v21 + 32) = v23;
*(_QWORD *)(v21 + 48) = v16;
*(_DWORD *)(v21 + 56) = v17;
memset(&a1, 0, 24);
v25 = p_P;
a1.m256i_i64[3] = 0x200000000i64;
if( *p_P != &P )
LABEL_60:
__fastfail(3u);
*(_QWORD *)(v21 + 8) = p_P;
*(_QWORD *)v21 = &P;
*v25 = v21;
p_P = (PVOID *)v21;
}
v16 = (wchar_t *)((char *)v16 + (_QWORD)SourceString);
v15 = cbDest;
v14 = *v16 == 0;
}
cbDest = v15 + 2;
v26 = (WCHAR *)ExAllocatePoolWithTag(PagedPool, cbDest, 0x76506343ui64);
if( v26 )
{
v27 = v3 + *(unsigned int *)(v3 + 108);
v28 = 0i64;
RemovableMedia = v27;
for( VolumeMounted = 0; (unsigned int)v28 < *(_DWORD *)(v3 + 112); VolumeMounted = v28 )
{
v29 = rcx0[2] + 112 * v28;
v30 = (unsigned int *)(v27 + 96 * v28);
*(_QWORD *)(v29 + 16) = v27 + *v30;
*(_DWORD *)(v29 + 24) = v30[1];
*(_DWORD *)(v29 + 104) = 0;
*(_QWORD *)(v29 + 96) = v27 + v30[7];
v31 = (PVOID *)P;
if( P == &P )
goto LABEL_53;
do
{
v32 = *((unsigned int *)v31 + 15);
v33 = v31;
a2 = v31[8];
if( PfMetadataRecordIsEqual((INT64)v30, &a2, v32) )
break;
v31 = (PVOID *)*v31;
}
while( v31 != &P );
if( v31 == &P )
goto LABEL_53;
RtlStringCbPrintfW(v26, cbDest, (WCHAR *)L"%s\\");
v34 = v26;
v52 = 0i64;
v35 = 0x7FFFi64;
do
{
if( !*v34 )
break;
++v34;
--v35;
}
while( v35 );
v36 = (0x7FFF - v35) & ((unsigned __int128)-(__int128)(unsigned __int64)v35 >> 64);
if( v35 )
{
*((_QWORD *)&v52 + 1) = v26;
LOWORD(v52) = 2 * v36;
WORD1(v52) = 2 * v36 + 2;
}
v37 = (__int64)(v33 + 2);
if( (int)PfpOpenHandleCreate((__int64)&v53, rcx0[1], (__int64)&v52, 0i64, 1179785, 0x21u, 0x80u, v37) < 0 )
{
LABEL_53:
memset(&v53, 0, 24);
v53.m256i_i64[3] = 0x200000000i64;
v45 = (INT64 **)rcx0[4];
if( *v45 != rcx0 + 3 )
goto LABEL_60;
*(_QWORD *)v29 = rcx0 + 3;
*(_QWORD *)(v29 + 8) = v45;
*v45 = (INT64 *)v29;
rcx0[4] = v29;
}
else
{
*(_OWORD *)(v29 + 32) = *(_OWORD *)v37;
*(_OWORD *)(v29 + 48) = *(_OWORD *)(v37 + 16);
v38 = *(_OWORD *)&v53.m256i_u64[2];
v53.m256i_i64[3] = 0x200000000i64;
*(_OWORD *)v37 = 0i64;
*(_OWORD *)(v37 + 16) = 0i64;
*(_QWORD *)(v37 + 24) |= 0x200000000ui64;
v39 = *(_OWORD *)v53.m256i_i8;
v53.m256i_i64[0] = 0i64;
*(_OWORD *)(v29 + 64) = v39;
*(_OWORD *)(v29 + 80) = v38;
v40 = (INT64 **)rcx0[6];
*(_OWORD *)&v53.m256i_u64[1] = 0i64;
if( *v40 != rcx0 + 5 )
goto LABEL_60;
*(_QWORD *)v29 = rcx0 + 5;
*(_QWORD *)(v29 + 8) = v40;
*v40 = (INT64 *)v29;
v41 = EventHandle;
rcx0[6] = v29;
*(_DWORD *)(v29 + 108) ^= (*(_DWORD *)(v29 + 108) ^ PfSnVolumeCheckSeekPenalty((HANDLE *)(v29 + 32), v41)) & 1;
if( (*(_DWORD *)(v29 + 108) & 1) != 0 )
{
v6 |= 1u;
}
else if( (v6 & 3) == 0 && !(unsigned int)PfSnVolumeCheckIsSdBus((HANDLE *)(v29 + 32), EventHandle) )
{
v6 |= 2u;
}
}
v27 = RemovableMedia;
v28 = VolumeMounted + 1;
}
v12 = 0;
*v57 = v6;
ExFreePoolWithTag(v26, 0);
}
else
{
LABEL_56:
v12 = -1073741670;
}
}
else
{
v12 = -1073741811;
}
LABEL_40:
if( (a1.m256i_i64[3] & 0x400000000i64) != 0 )
PfpOpenHandleClose(&a1, rcx0[1]);
while( 1 )
{
v42 = P;
if( P == &P )
break;
if( *((PVOID **)P + 1) != &P )
goto LABEL_60;
v43 = *(_QWORD *)P;
if( *(PVOID *)(*(_QWORD *)P + 8i64) != P )
goto LABEL_60;
P = *(PVOID *)P;
*(_QWORD *)(v43 + 8) = &P;
if( (v42[5] & 0x400000000i64) != 0 )
PfpOpenHandleClose(v42 + 2, rcx0[1]);
ExFreePoolWithTag(v42, 0);
}
if( v5 )
ExFreePoolWithTag(v5, 0);
if( EventHandle )
NtClose(EventHandle);
PfSnLogOpenVolumesForPrefetch(v3, 0, v7);
return(unsigned int)v12;
}Referenced by:
PfSnAsyncPrefetchWorker