PfSnGetSectionObject

INT64 __fastcall PfSnGetSectionObject(
        INT64 rcx0,
        INT64 a2,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 EventHandle,
        INT64 a9,
        INT64 a10){
  __int128 v11; 
  __int64 v12; 
  void *v15; 
  __int64 v16; 
  int v17; 
  __int64 v18; 
  int v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int128 v23; 
  NTSTATUS v24; 
  struct _DMA_ADAPTER *v25; 
  INT64 v26; 
  UINT64 v27; 
  UINT64 v28; 
  __int64 v29; 
  UINT64 v30; 
  int v31; 
  unsigned __int8 v32; 
  int v34; 
  __int64 v35; 
  UINT64 SectionPageProtection; 
  UINT64 AllocationAttributes; 
  void *SectionHandle; 
  PVOID Object; 
  int v40; 
  __int64 Information; 
  __m256i v42; 
  UINT64 ReturnedLength; 
  _QWORD *v44; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v46[4]; 
  __int64 v47; 
  v11 = 0i64;
  Object = (PVOID)a3;
  v12 = 0x200000000i64;
  *(_QWORD *)a9 = 0i64;
  v47 = 0i64;
  v44 = (_QWORD *)a9;
  v15 = 0i64;
  *(_BYTE *)a10 = 0;
  v16 = *(_QWORD *)rcx0;
  *(&ObjectAttributes.Length + 1) = 0;
  v17 = (_DWORD)a7 != 0 ? 285212672 : 0x4000000;
  *(&ObjectAttributes.Attributes + 1) = 0;
  *(_OWORD *)v46 = 0i64;
  Information = 0i64;
  memset(&v42, 0, 24);
  v42.m256i_i64[3] = 0x200000000i64;
  SectionHandle = 0i64;
  v40 = v17;
  if( (unsigned int)a6 >= *(_DWORD *)(v16 + 88) )
  {
    v19 = -1073741811;
    goto LABEL_27;
  }
  v18 = *(_QWORD *)(rcx0 + 56) + 56i64 * (unsigned int)a6;
  if( (*(_QWORD *)(v18 + 24) & 0x400000000i64) == 0 )
  {
    if( (*(_DWORD *)(a2 + 108) & 1) == 0 )
    {
      v35 = *(_QWORD *)(a4 + 24);
      *(_QWORD *)&v46[2] = 0i64;
      v47 = v35;
      v46[0] = 3;
      v46[1] = 1;
      if( v35 )
        PfSnPrefetchFileMetadata(rcx0, *(void **)(a2 + 32), (__int64)v46, 0, 1, (HANDLE)EventHandle);
    }
    v19 = PfpOpenHandleCreate(
            (__int64)&v42,
            *(_QWORD *)(rcx0 + 8),
            (__int64)Object,
            *(_QWORD *)(a2 + 64),
            161,
            0x40u,
            0x80u,
            a2 + 32);
    if( v19 < 0 || (v19 = PfpFileCheckAttributesForPrefetch((VOID *)v42.m256i_i64[0]), v19 < 0) )
    {
      v12 = v42.m256i_i64[3];
      goto LABEL_27;
    }
    if( *(_DWORD *)(rcx0 + 120) < *(_DWORD *)(rcx0 + 124)
      && (int)IopQueryXxxInformation(
                (FILE_OBJECT *)v42.m256i_i64[1],
                6ui64,
                8ui64,
                0,
                &Information,
                &ReturnedLength,
                1u) >= 0 )
    {
      v20 = (unsigned int)_InterlockedExchangeAdd((volatile signed __int32 *)(rcx0 + 120), 1u);
      v21 = *(_QWORD *)(rcx0 + 112);
      v22 = 3 * v20;
      *(_QWORD *)(v21 + 8 * v22 + 12) = Information;
      LODWORD(v20) = v42.m256i_i32[6];
      *(_QWORD *)(v21 + 8 * v22) = *(_QWORD *)(v42.m256i_i64[1] + 24);
      *(_DWORD *)(v21 + 8 * v22 + 8) = v20;
    }
    v15 = SectionHandle;
    v23 = *(_OWORD *)&v42.m256i_u64[2];
    v17 = v40;
    *(_OWORD *)v18 = *(_OWORD *)v42.m256i_i8;
    memset(&v42, 0, 24);
    v11 = 0i64;
    v42.m256i_i64[3] = 0x200000000i64;
    *(_OWORD *)(v18 + 16) = v23;
  }
  if( (_DWORD)a7 )
  {
    if( *(_QWORD *)(v18 + 32) )
    {
      v27 = (unsigned int)a5;
      v26 = a4;
      goto LABEL_33;
    }
  }
  else if( *(_QWORD *)(v18 + 40) )
  {
    if( !PfSnIsSectionPrefetchedAfterPhase(a4, 0i64, (unsigned int)a5) )
      goto LABEL_16;
LABEL_17:
    *v44 = *(_QWORD *)(v18 + 8);
    if( !PfSnIsSectionPrefetchedAfterPhase(a4, 1i64, v28)
      && !PfSnIsSectionPrefetchedAfterPhase(a4, 0i64, v30)
      && ((v32 & (unsigned __int8)BYTE1(*(_DWORD *)(a4 + 20)) & 0x7F) == 0 || (_DWORD)a7 != v31) )
    {
      *(_DWORD *)(v18 + 48) |= 4u;
    }
    v19 = v31;
    goto LABEL_23;
  }
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = v11;
  LODWORD(AllocationAttributes) = v17;
  LODWORD(SectionPageProtection) = 2;
  v19 = NtCreateSection(
          &SectionHandle,
          5ui64,
          &ObjectAttributes,
          0i64,
          SectionPageProtection,
          AllocationAttributes,
          *(PVOID *)v18);
  if( v19 >= 0 )
  {
    v15 = SectionHandle;
    Object = 0i64;
    v24 = ObReferenceObjectByHandle(SectionHandle, 5u, MmSectionObjectType, 0, &Object, 0i64);
    v25 = (struct _DMA_ADAPTER *)Object;
    v19 = v24;
    if( v24 < 0 )
    {
LABEL_23:
      if( v25 )
        HalPutDmaAdapter(v25);
      goto LABEL_25;
    }
    v26 = a4;
    v27 = (unsigned int)a5;
    if( !(_DWORD)a7 )
    {
      *(_QWORD *)(v18 + 40) = Object;
      if( !PfSnIsSectionPrefetchedAfterPhase(a4, 0i64, (unsigned int)a5) )
      {
LABEL_16:
        *(_DWORD *)(v18 + 48) |= 2u;
        *(_BYTE *)a10 = 1;
        goto LABEL_17;
      }
      if( *(_QWORD *)(v18 + 32) != v29
        || !PfSnIsSectionPrefetchedAfterPhase(a4, 1i64, v28)
        && ((unsigned __int8)v28 & (unsigned __int8)BYTE1(*(_DWORD *)(a4 + 20)) & 0x7F) == 0 )
      {
        goto LABEL_17;
      }
      *(_DWORD *)(v18 + 48) |= 2u;
LABEL_35:
      *(_BYTE *)a10 = v34;
      goto LABEL_17;
    }
    *(_QWORD *)(v18 + 32) = Object;
LABEL_33:
    if( PfSnIsSectionPrefetchedAfterPhase(v26, 1i64, v27) )
      goto LABEL_17;
    *(_DWORD *)(v18 + 48) |= v34;
    goto LABEL_35;
  }
  v15 = SectionHandle;
LABEL_25:
  if( v15 )
    NtClose(v15);
LABEL_27:
  if( (v12 & 0x400000000i64) != 0 )
    PfpOpenHandleClose(&v42, *(_QWORD *)(rcx0 + 8));
  return(unsigned int)v19;
}

Referenced by: