PfpRpFileKeyUpdate
INT64 __fastcall PfpRpFileKeyUpdate(INT64 a1, INT64 a2, INT64 a3){
unsigned int v3;
int v4;
int v5;
PVOID v8;
_QWORD *v9;
unsigned int v10;
WCHAR *v11;
__int64 v12;
__int64 v13;
WCHAR *j;
unsigned __int8 v15;
_ETHREAD *CurrentThread;
int v17;
__int64 v18;
__int64 v19;
__int64 v20;
void *v21;
unsigned int v22;
char v23;
unsigned __int64 v24;
_QWORD *v25;
unsigned __int64 v27;
_QWORD *i;
_QWORD *v29;
void *v30;
PVOID PoolWithTag;
unsigned __int64 v32;
unsigned __int64 v33;
unsigned __int64 v34;
PEX_RUNDOWN_REF RunRef;
unsigned int v36;
_QWORD *P;
__int64 v38;
v3 = 0;
v38 = *(_QWORD *)(a2 + 16);
v4 = a3;
v5 = *(_DWORD *)(a1 + 152);
P = 0i64;
PoolWithTag = 0i64;
v8 = 0i64;
v36 = 0;
v9 = 0i64;
if( (v5 & 1) == 0 )
return 3221225600i64;
RunRef = (PEX_RUNDOWN_REF)(a1 + 136);
if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)(a1 + 136)) )
return 3221225600i64;
if( !v4 )
{
v13 = 0i64;
LABEL_9:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx(a1 + 48, 0i64);
if( v4 )
{
v17 = *(_DWORD *)(a1 + 4) >> 5;
v18 = -1i64 << (*(_BYTE *)(a1 + 4) & 0x1F);
v19 = v38 & v18;
v34 = (v38 & (unsigned __int64)v18) >> 32;
v33 = (v38 & (unsigned __int64)v18) >> 24;
v32 = (v38 & (unsigned __int64)v18) >> 16;
if( v17 )
{
v20 = *(_QWORD *)(a1 + 8)
+ 8
* ((((v38 & (unsigned __int64)v18) >> 56)
+ 37
* ((unsigned __int8)((v38 & (unsigned __int64)v18) >> 48)
+ 37
* ((unsigned __int8)((unsigned __int16)((v38 & (unsigned __int64)v18) >> 32) >> 8)
+ 37
* ((unsigned __int8)v34
+ 37
* ((unsigned __int8)v33
+ 37
* ((unsigned __int8)v32
+ 37
* ((unsigned __int8)((unsigned __int16)(v38 & v18) >> 8)
+ 37 * ((unsigned int)(unsigned __int8)v19 + 11623883)))))))) & (unsigned int)(v17 - 1));
while( 1 )
{
v20 = *(_QWORD *)v20;
if( (v20 & 1) != 0 )
break;
if( v19 == (v18 & *(_QWORD *)(v20 + 8)) )
{
*(_QWORD *)(v20 + 16) = v13;
goto LABEL_15;
}
}
}
*P = 0i64;
P[1] = v38;
P[2] = v13;
if( (unsigned int)PfpRpRehashIfNeeded(a1, &PoolWithTag, v36) )
{
v22 = *(_DWORD *)(a1 + 4);
v21 = 0i64;
v23 = v22 & 0x1F;
v24 = P[1] & (-1i64 << (v22 & 0x1F));
v25 = (_QWORD *)(*(_QWORD *)(a1 + 8)
+ 8
* ((HIBYTE(v24)
+ 37
* ((unsigned __int8)((P[1] & (unsigned __int64)(-1i64 << v23)) >> 48)
+ 37
* ((unsigned __int8)((unsigned __int16)((P[1] & (unsigned __int64)(-1i64 << v23)) >> 32) >> 8)
+ 37
* ((unsigned __int8)((P[1] & (unsigned __int64)(-1i64 << v23)) >> 32)
+ 37
* ((((_DWORD)P[1] & (unsigned int)(-1 << v23)) >> 24)
+ 37
* ((unsigned __int8)(((_DWORD)P[1] & (unsigned int)(-1 << v23)) >> 16)
+ 37
* (37 * ((unsigned __int8)v24 + 11623883)
+ (unsigned __int8)((unsigned __int16)(P[1] & (-1 << v23)) >> 8)))))))) & ((v22 >> 5) - 1)));
*P = *v25;
*v25 = P;
++*(_DWORD *)a1;
}
else
{
v3 = -1073741670;
v21 = P;
}
}
else
{
LABEL_28:
if( *(_DWORD *)a1 )
{
v27 = v38 & (-1i64 << (*(_DWORD *)(a1 + 4) & 0x1F));
for( i = (_QWORD *)(*(_QWORD *)(a1 + 8)
+ 8
* ((37
* (BYTE6(v27)
+ 37
* (BYTE5(v27)
+ 37
* (BYTE4(v27)
+ 37
* ((((unsigned int)v38 & (-1 << (*(_DWORD *)(a1 + 4) & 0x1F))) >> 24)
+ 37
* ((unsigned __int8)(((unsigned int)v38 & (-1 << (*(_DWORD *)(a1 + 4) & 0x1F))) >> 16)
+ 37
* ((unsigned __int8)((unsigned __int16)(v38 & (-1 << (*(_DWORD *)(a1 + 4) & 0x1F))) >> 8)
+ 37 * ((unsigned __int8)v27 + 11623883)))))))
+ HIBYTE(v27)) & ((*(_DWORD *)(a1 + 4) >> 5) - 1))); ; i = (_QWORD *)*i )
{
v29 = (_QWORD *)*i;
if( (*i & 1) != 0 )
break;
if( ((-1i64 << (*(_DWORD *)(a1 + 4) & 0x1F)) & v29[1]) == v27 )
{
*i = *v29;
--*(_DWORD *)a1;
*v29 |= 0x8000000000000002ui64;
if( *(_QWORD **)(a1 + 16) == v29 )
*(_QWORD *)(a1 + 16) = a1 + 24;
*v29 = v9;
v9 = v29;
goto LABEL_28;
}
}
}
LABEL_15:
v21 = P;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(a1 + 48), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(a1 + 48));
KeAbPostRelease((PVOID)(a1 + 48));
KeLeaveCriticalRegion();
v8 = PoolWithTag;
goto LABEL_21;
}
P = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x4B466650ui64);
if( P )
{
v10 = 2 * (*(_DWORD *)(a1 + 4) >> 5);
if( *(_DWORD *)a1 >= v10 )
{
v36 = 2 * (*(_DWORD *)(a1 + 4) >> 5);
if( !v10 )
{
v10 = 64;
v36 = 64;
}
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 8i64 * v10, 0x48466650ui64);
v8 = PoolWithTag;
if( !PoolWithTag )
v36 = 0;
}
v11 = *(WCHAR **)(a2 + 24);
v12 = *(unsigned __int16 *)(a2 + 34);
v13 = 314159i64;
for( j = &v11[v12]; v11 < j; v13 = 37 * (v15 + 37 * v13) )
v15 = RtlUpcaseUnicodeChar(*v11++);
if( v13 )
goto LABEL_9;
v21 = P;
v3 = -1073741747;
}
else
{
v3 = -1073741670;
v21 = 0i64;
}
LABEL_21:
ExReleaseRundownProtection(RunRef);
if( v21 )
ExFreePoolWithTag(v21, 0);
while( v9 )
{
v30 = v9;
v9 = (_QWORD *)*v9;
ExFreePoolWithTag(v30, 0);
}
if( v8 )
ExFreePoolWithTag(v8, 0);
return v3;
}Referenced by:
PfFileInfoNotify