PfpCopyEvent

INT64 __fastcall PfpCopyEvent(INT64 *Src){
  unsigned __int64 v1; 
  int v2; 
  __int64 v4; 
  unsigned __int8 v5; 
  __int64 v6; 
  __int64 v7; 
  INT64 v8; 
  INT64 v9; 
  INT64 *v10; 
  unsigned __int64 v11; 
  __int64 v13; 
  __int64 v14; 
  _EPROCESS *v15; 
  unsigned __int64 v16; 
  INT64 a5; 
  _BYTE a3[16]; 
  INT64 a2; 
  _EPROCESS *Process; 
  v1 = *Src;
  v2 = *Src;
  Process = 0i64;
  LODWORD(a2) = 0;
  if( (v2 & 0x1F000) != 40960i64 )
  {
    v13 = (v1 >> 2) & 0x3FF;
    v14 = PfTAcquireLogEntry((__int64)&qword_140C4F918, &a2, (v1 >> 2) & 0x3FF);
    if( !v14 )
      return 3221225626i64;
    memmove(
      (UINT8 *)(((v14 + 31) & 0xFFFFFFFFFFFFFFF8ui64) + 16i64 * (unsigned int)a2),
      (UINT8 *)Src,
      (unsigned int)(16 * v13));
    return 0i64;
  }
  v4 = Src[4];
  v5 = v4;
  *(_OWORD *)a3 = 0i64;
  if( (v4 & 0x7FFFFFFFFFFFFFFFui64) >= 0xFF )
    v5 = -1;
  v6 = 2i64;
  if( v4 >= 0 )
    v6 = 4098i64;
  v7 = (_DWORD)Src[6] & 0xFF000000;
  LODWORD(a5) = 1;
  *(_DWORD *)&a3[8] = v5 | (*((_DWORD *)Src + 12) << 8);
  v8 = Src[5];
  v9 = Src[3] << 12;
  *(_QWORD *)a3 = v6 & 0xFFFFFFFF00FFFFFFui64 | v7;
  a2 = v9 | 1;
  v10 = PfpLogPageAccess(v8, &a2, a3, (INT64)(Src + 3), a5);
  if( !v10 )
    return 3221225864i64;
  v11 = ((qword_140C4F958 + 47) & 0xFFFFFFFFFFFFFFF8ui64)
      + 40i64 * (*((unsigned __int16 *)v10 + 5) - (unsigned int)*(unsigned __int16 *)(qword_140C4F958 + 36));
  if( (*(_BYTE *)(v11 + 8) & 4) == 0
    || PsLookupProcessByProcessId((HANDLE)*((unsigned int *)Src + 13), (PEPROCESS *)&Process) < 0 )
  {
    return 0i64;
  }
  v15 = Process;
  if( ((*((_QWORD *)Process + 136) ^ *((_QWORD *)Process + 141)) & 0x1FFFFFFFFFFFFFFFi64) == Src[5]
    && PfpIsProcessInfoPresent((__int64)Process) )
  {
    v16 = *(_QWORD *)(v11 + 8) & 0xFFFFFFFFFFFFFFF8ui64 | 1;
    *(_QWORD *)(v11 + 8) = v16;
    *(_QWORD *)(v11 + 8) = v16 & 7 | (8i64 * (*((_QWORD *)v15 + 136) ^ *((_QWORD *)v15 + 141)));
    *(_DWORD *)(v11 + 28) = *((_DWORD *)v15 + 381);
    *(_DWORD *)(v11 + 24) = *((_DWORD *)v15 + 272);
    *(_QWORD *)(v11 + 16) = v15;
  }
  ObfDereferenceObjectWithTag(v15, 0x746C6644ui64);
  return 0i64;
}

Referenced by: