PfFileInfoNotify
INT64 __fastcall PfFileInfoNotify(INT64 a1){
_DWORD *v1;
bool v2;
int v3;
int v4;
UINT64 v5;
__int64 v6;
unsigned __int64 v7;
__int64 v8;
__int64 v9;
__int64 v10;
unsigned __int64 v11;
__int64 v12;
__int64 v13;
unsigned int v14;
__int64 v15;
PSLIST_ENTRY v16;
unsigned __int64 *v17;
__int64 v18;
int v19;
INT64 v20;
PSLIST_ENTRY j;
int v22;
unsigned __int64 v23;
__int128 v24;
__int128 v25;
_SLIST_ENTRY *Next;
INT64 v28;
unsigned __int64 v29;
__int64 v30;
UINT64 v31;
struct _EX_RUNDOWN_REF *v32;
struct _EX_RUNDOWN_REF *v33;
int v34;
INT64 v35;
__int64 v36;
unsigned int v37;
UINT8 *v38;
int v39;
unsigned int v40;
unsigned int v41;
int v42;
INT64 v43;
int v44;
wchar_t *v45;
INT64 v46;
int v47;
unsigned __int64 v48;
__int64 *v49;
__int64 *v50;
unsigned __int64 v51;
INT64 v52;
INT64 v53;
int v54;
int *v55;
int v56;
int v57;
unsigned int v58;
int v59;
INT64 v60;
__int16 v61;
int v62;
_ETHREAD *CurrentThread;
unsigned int v64;
_ETHREAD *v65;
_ETHREAD *v66;
unsigned int SessionId;
int v68;
__int64 v69;
unsigned __int64 v70;
_ETHREAD *v71;
int v72;
__int64 v73;
unsigned __int64 v74;
__int64 v75;
__int64 v76;
int v77;
_ETHREAD *v78;
unsigned int v79;
_ETHREAD *v80;
__int64 i;
_ETHREAD *v82;
unsigned int v83;
int v84;
__int64 v85;
unsigned __int64 v86;
__int64 v87;
_ETHREAD *v88;
int v89;
__int64 v90;
unsigned __int64 v91;
__int64 v92;
struct _SLIST_ENTRY *v93;
VOID **BugCheckParameter4;
UINT64 v95;
int v96;
int v97;
int v98;
int v99;
int v100;
PSLIST_ENTRY ListEntry;
INT64 a3;
int v103;
int v104;
__int64 v105;
unsigned __int64 v106;
__int64 v107[2];
int v108;
int v109;
__int128 v110;
__int128 v111;
unsigned __int64 v112;
char v114;
char v115;
char v116;
char v117;
_QWORD *a2;
int v119;
int v120;
v1 = (_DWORD *)a1;
v2 = *(_DWORD *)a1 == 15;
v104 = 0;
v109 = 0;
ListEntry = 0i64;
a3 = 0i64;
if( !v2 )
{
v22 = -1073741811;
goto LABEL_62;
}
v3 = *(_DWORD *)(a1 + 8);
if( (v3 & 8) != 0 )
{
v34 = *(_DWORD *)(a1 + 4);
if( v34 == 7 )
{
v1[4] = _InterlockedIncrement(&dword_140CEBED0);
}
else
{
v62 = v34 - 10;
if( !v62 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50148, 0i64);
v64 = -1;
if( qword_140C50138 )
{
v22 = -1073741791;
}
else
{
v65 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v65 + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50150, 0i64);
dword_140C50168 &= ~1u;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50150, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50150);
v98 = 0;
v66 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&qword_140C50150) == 1 )
SessionId = MmGetSessionIdEx(*((_QWORD *)v66 + 23));
else
SessionId = -1;
--*((_WORD *)v66 + 243);
++*((_BYTE *)v66 + 794);
v68 = (*((char *)v66 + 792) | *((char *)v66 + 870)) ^ 0x3F;
v114 = *((_BYTE *)v66 + 794);
v2 = !_BitScanReverse((unsigned int *)&v69, v68);
v97 = v69;
if( v2 )
goto LABEL_85;
while( 1 )
{
v70 = *((_QWORD *)v66 + 100) + 96 * v69;
v68 &= ~(1 << v69);
if( (*(_BYTE *)(v70 + 26) & 1) != 0
&& (*(_DWORD *)(v70 + 32) & 1) == 0
&& (*(_QWORD *)(v70 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50150 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v70 + 40) == SessionId )
{
*(_BYTE *)(v70 + 26) &= ~1u;
if( *(_QWORD *)(v70 + 32) )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v69, v68);
v97 = v69;
if( v2 )
goto LABEL_85;
}
if( !v70 )
{
LABEL_85:
if( (*((_DWORD *)v66 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v66, (ULONG_PTR)&qword_140C50150, SessionId, 0i64);
}
else
{
*(_BYTE *)(v70 + 32) |= 2u;
if( *(__int64 *)(v70 + 32) < 0 )
KiAbEntryRemoveFromTree(v70);
v98 = *(_DWORD *)(v70 + 88) & 0x1FFFF;
*(_DWORD *)(v70 + 88) &= 0xFFFE0000;
*(_BYTE *)(v70 + 25) &= ~1u;
*(_QWORD *)(v70 + 32) = 0i64;
v75 = (__int64)(v70 - *((_QWORD *)v66 + 100)) / 96;
if( v114 == 1 )
*((_BYTE *)v66 + 792) |= 1 << v75;
else
_InterlockedOr8((volatile signed __int8 *)v66 + 870, 1 << v75);
}
--*((_BYTE *)v66 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v66, (__int64)&qword_140C50150, (unsigned int *)&v98);
v2 = (*((_WORD *)v66 + 243))++ == 0xFFFF;
if( v2 && *((_ETHREAD **)v66 + 19) != (_ETHREAD *)((char *)v66 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
(*(void(__fastcall **)(__int64(__fastcall *)(__int64 *, __int64, void(__fastcall **)(volatile signed __int64 *, unsigned __int64))))(*((_QWORD *)v1 + 2) + 32i64))(PfpPrefetchSharedConflictNotifyStart);
qword_140C50138 = *((_QWORD *)v1 + 2);
v22 = 0;
_InterlockedExchange64((volatile __int64 *)&RunRef, 0i64);
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50148, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50148);
v100 = 0;
v71 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&qword_140C50148) == 1 )
v64 = MmGetSessionIdEx(*((_QWORD *)v71 + 23));
--*((_WORD *)v71 + 243);
++*((_BYTE *)v71 + 794);
v72 = (*((char *)v71 + 792) | *((char *)v71 + 870)) ^ 0x3F;
v115 = *((_BYTE *)v71 + 794);
v2 = !_BitScanReverse((unsigned int *)&v73, v72);
v99 = v73;
if( v2 )
goto LABEL_97;
while( 1 )
{
v74 = *((_QWORD *)v71 + 100) + 96 * v73;
v72 &= ~(1 << v73);
if( (*(_BYTE *)(v74 + 26) & 1) != 0
&& (*(_DWORD *)(v74 + 32) & 1) == 0
&& (*(_QWORD *)(v74 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50148 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v74 + 40) == v64 )
{
*(_BYTE *)(v74 + 26) &= ~1u;
if( *(_QWORD *)(v74 + 32) )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v73, v72);
v99 = v73;
if( v2 )
goto LABEL_97;
}
if( !v74 )
{
LABEL_97:
if( (*((_DWORD *)v71 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v71, (ULONG_PTR)&qword_140C50148, v64, 0i64);
}
else
{
*(_BYTE *)(v74 + 32) |= 2u;
if( *(__int64 *)(v74 + 32) < 0 )
KiAbEntryRemoveFromTree(v74);
v100 = *(_DWORD *)(v74 + 88) & 0x1FFFF;
*(_DWORD *)(v74 + 88) &= 0xFFFE0000;
*(_BYTE *)(v74 + 25) &= ~1u;
*(_QWORD *)(v74 + 32) = 0i64;
v76 = (__int64)(v74 - *((_QWORD *)v71 + 100)) / 96;
if( v115 == 1 )
*((_BYTE *)v71 + 792) |= 1 << v76;
else
_InterlockedOr8((volatile signed __int8 *)v71 + 870, 1 << v76);
}
--*((_BYTE *)v71 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v71, (__int64)&qword_140C50148, (unsigned int *)&v100);
v2 = (*((_WORD *)v71 + 243))++ == 0xFFFF;
if( v2 && *((_ETHREAD **)v71 + 19) != (_ETHREAD *)((char *)v71 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
goto LABEL_20;
}
v77 = v62 - 1;
if( !v77 )
{
v78 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v78 + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50148, 0i64);
v79 = -1;
if( qword_140C50138 )
{
v80 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v80 + 242);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C50150, 0i64);
dword_140C50168 |= 1u;
for( i = qword_140C50158; (__int64 *)i != &qword_140C50158; i = *(_QWORD *)i )
{
*(_DWORD *)(i + 68) |= 4u;
KeSetEvent((PRKEVENT)(i + 88), 0);
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50150, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50150);
v119 = 0;
v82 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&qword_140C50150) == 1 )
v83 = MmGetSessionIdEx(*((_QWORD *)v82 + 23));
else
v83 = -1;
--*((_WORD *)v82 + 243);
++*((_BYTE *)v82 + 794);
v84 = (*((char *)v82 + 792) | *((char *)v82 + 870)) ^ 0x3F;
v116 = *((_BYTE *)v82 + 794);
v2 = !_BitScanReverse((unsigned int *)&v85, v84);
if( v2 )
goto LABEL_148;
while( 1 )
{
v86 = *((_QWORD *)v82 + 100) + 96 * v85;
v84 &= ~(1 << v85);
if( (*(_BYTE *)(v86 + 26) & 1) != 0
&& (*(_DWORD *)(v86 + 32) & 1) == 0
&& (*(_QWORD *)(v86 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50150 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v86 + 40) == v83 )
{
*(_BYTE *)(v86 + 26) &= ~1u;
if( *(_QWORD *)(v86 + 32) )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v85, v84);
if( v2 )
goto LABEL_148;
}
if( !v86 )
{
LABEL_148:
if( (*((_DWORD *)v82 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v82, (ULONG_PTR)&qword_140C50150, v83, 0i64);
}
else
{
*(_BYTE *)(v86 + 32) |= 2u;
if( *(__int64 *)(v86 + 32) < 0 )
KiAbEntryRemoveFromTree(v86);
v119 = *(_DWORD *)(v86 + 88) & 0x1FFFF;
*(_DWORD *)(v86 + 88) &= 0xFFFE0000;
*(_BYTE *)(v86 + 25) &= ~1u;
*(_QWORD *)(v86 + 32) = 0i64;
v87 = (__int64)(v86 - *((_QWORD *)v82 + 100)) / 96;
if( v116 == 1 )
*((_BYTE *)v82 + 792) |= 1 << v87;
else
_InterlockedOr8((volatile signed __int8 *)v82 + 870, 1 << v87);
}
--*((_BYTE *)v82 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v82, (__int64)&qword_140C50150, (unsigned int *)&v119);
v2 = (*((_WORD *)v82 + 243))++ == 0xFFFF;
if( v2 && *((_ETHREAD **)v82 + 19) != (_ETHREAD *)((char *)v82 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
ExWaitForRundownProtectionRelease((EX_RUNDOWN_REF *)&RunRef);
ExRundownCompleted((EX_RUNDOWN_REF *)&RunRef);
qword_140C50138 = 0i64;
v22 = 0;
}
else
{
v22 = -1073741275;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C50148, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C50148);
v96 = 0;
v88 = (_ETHREAD *)KeGetCurrentThread();
if( (unsigned int)MiGetSystemRegionType((UINT64)&qword_140C50148) == 1 )
v79 = MmGetSessionIdEx(*((_QWORD *)v88 + 23));
--*((_WORD *)v88 + 243);
++*((_BYTE *)v88 + 794);
v89 = (*((char *)v88 + 792) | *((char *)v88 + 870)) ^ 0x3F;
v117 = *((_BYTE *)v88 + 794);
v2 = !_BitScanReverse((unsigned int *)&v90, v89);
v120 = v90;
if( v2 )
goto LABEL_172;
while( 1 )
{
v91 = *((_QWORD *)v88 + 100) + 96 * v90;
v89 &= ~(1 << v90);
if( (*(_BYTE *)(v91 + 26) & 1) != 0
&& (*(_DWORD *)(v91 + 32) & 1) == 0
&& (*(_QWORD *)(v91 + 32) & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50148 & 0x7FFFFFFFFFFFFFFCi64)
&& *(_DWORD *)(v91 + 40) == v79 )
{
*(_BYTE *)(v91 + 26) &= ~1u;
if( *(_QWORD *)(v91 + 32) )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v90, v89);
v120 = v90;
if( v2 )
goto LABEL_172;
}
if( !v91 )
{
LABEL_172:
if( (*((_DWORD *)v88 + 30) & 0x10000) == 0 )
KeBugCheckEx(0x162u, (ULONG_PTR)v88, (ULONG_PTR)&qword_140C50148, v79, 0i64);
}
else
{
*(_BYTE *)(v91 + 32) |= 2u;
if( *(__int64 *)(v91 + 32) < 0 )
KiAbEntryRemoveFromTree(v91);
v96 = *(_DWORD *)(v91 + 88) & 0x1FFFF;
*(_DWORD *)(v91 + 88) &= 0xFFFE0000;
*(_BYTE *)(v91 + 25) &= ~1u;
*(_QWORD *)(v91 + 32) = 0i64;
v92 = (__int64)(v91 - *((_QWORD *)v88 + 100)) / 96;
if( v117 == 1 )
*((_BYTE *)v88 + 792) |= 1 << v92;
else
_InterlockedOr8((volatile signed __int8 *)v88 + 870, 1 << v92);
}
--*((_BYTE *)v88 + 794);
KiAbThreadRemoveBoosts((ULONG_PTR)v88, (__int64)&qword_140C50148, (unsigned int *)&v96);
v2 = (*((_WORD *)v88 + 243))++ == 0xFFFF;
if( v2 && *((_ETHREAD **)v88 + 19) != (_ETHREAD *)((char *)v88 + 152) )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
goto LABEL_20;
}
if( v77 != 1 )
{
LABEL_123:
v22 = -1073741637;
goto LABEL_62;
}
if( (dword_140C50290 & 2) != 0 )
{
v22 = -1073741431;
goto LABEL_62;
}
}
return 0;
}
if( (v3 & 4) != 0 )
{
v47 = *(_DWORD *)(a1 + 4);
if( v47 == 2 )
{
PfSnLogStreamCreate(*(_QWORD *)(a1 + 16));
}
else if( v47 )
{
if( v47 == 3 )
PfSnNameRemoveAll(*(_QWORD *)(a1 + 16));
}
else
{
PfSnLogVolumeCreate(*(_QWORD *)(a1 + 16));
}
}
if( (v1[2] & 1) == 0 )
return 0;
if( dword_140C4FB20 >= (unsigned int)dword_140C4FB24 )
{
v54 = v1[1];
v4 = v54;
if( v54 != 4 && v54 != 2 && v54 != 3 )
{
v22 = -1073741697;
goto LABEL_62;
}
}
else
{
v4 = v1[1];
}
if( v4 == 4 )
{
v5 = *((_QWORD *)v1 + 2);
v6 = *(unsigned int *)(v5 + 16) + 4095i64;
v7 = (v6 + (unsigned __int64)(*(_DWORD *)(v5 + 8) & 0xFFF)) >> 12;
if( PfSnNumActiveTraces )
{
v28 = *(_QWORD *)(v5 + 32);
v29 = (v6 + (unsigned __int64)(*(_DWORD *)(v5 + 8) & 0xFFF)) >> 12;
v30 = *(_QWORD *)(v5 + 8);
v31 = *(_QWORD *)(v5 + 24);
a2 = *(_QWORD **)v5;
v32 = PfSnReferenceProcessTrace(*(_QWORD *)(v28 + 544), v5);
v33 = v32;
if( v32 )
{
if( (unsigned int)PfSnCheckLoggingForThread(v28, (INT64)v32, 0) )
{
v48 = v30 & 0xFFFFFFFFFFFFF000ui64;
if( v7 )
{
do
{
LODWORD(BugCheckParameter4) = 0;
if( (int)PfSnLogPageFaultCommon((INT64)v33, a2, v31, v48, (INT64)BugCheckParameter4) < 0 )
break;
v48 += 4096i64;
--v29;
}
while( v29 );
v1 = (_DWORD *)a1;
}
}
ExReleaseRundownProtection(v33 + 45);
}
}
if( dword_140C4FB20 < (unsigned int)dword_140C4FB24 )
{
v8 = *((_QWORD *)v1 + 2);
v9 = *(_QWORD *)(v8 + 32);
v10 = *(int *)(v8 + 20);
v11 = *(_QWORD *)(v8 + 8);
v12 = *(_QWORD *)(v8 + 24);
v13 = *(_QWORD *)(v9 + 544);
v14 = (*(_DWORD *)(v9 + 1296) >> 12) & 7;
if( (*(_DWORD *)(v13 + 1124) & 0x100000) != 0 )
{
v57 = 2;
if( v14 < 2 )
v57 = (*(_DWORD *)(v9 + 1296) >> 12) & 7;
v14 = v57;
}
if( v14 < dword_140C4E56C )
{
v22 = 0;
goto LABEL_20;
}
v15 = *(_QWORD *)(v13 + 1088);
*(_QWORD *)&v111 = v7 | (v10 << 63);
v16 = 0i64;
v17 = 0i64;
v18 = (v15 ^ *(_QWORD *)(v13 + 1128)) & 0x1FFFFFFFFFFFFFFFi64;
*(_QWORD *)&v110 = v12;
*((_QWORD *)&v111 + 1) = v18;
v112 = __PAIR64__(v15, dword_140CEBED0);
*((_QWORD *)&v110 + 1) = v11 >> 12;
v19 = dword_140C5001C
+ ((((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10);
if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)&stru_140C4FA60) )
{
while( 1 )
{
for( j = RtlpInterlockedPopEntrySList((PSLIST_HEADER)qword_140C4FA80);
!j;
j = RtlpInterlockedPopEntrySList((PSLIST_HEADER)qword_140C4FA80) )
{
j = RtlpInterlockedPopEntrySList((PSLIST_HEADER)qword_140C4FA70);
if( j )
break;
v22 = ((__int64(__fastcall *)(INT64 *))qword_140C4FAB8)(&stru_140C4FA60);
if( v22 < 0 )
goto LABEL_190;
}
v20 = *((_QWORD *)&j[1].Next + 1);
if( (__int64)j[2].Next - v20 >= 64 )
{
v17 = (unsigned __int64 *)*((_QWORD *)&j[1].Next + 1);
v16 = j;
v22 = 0;
goto LABEL_16;
}
if( !*((_DWORD *)&j[2].Next + 2) )
break;
((void(*)(void))qword_140C4FAC0)();
if( !ExAcquireRundownProtection((PEX_RUNDOWN_REF)&stru_140C4FA60) )
goto LABEL_185;
}
RtlpInterlockedPushEntrySList((PSLIST_HEADER)qword_140C4FA70, j);
v22 = -1073741789;
LABEL_190:
++dword_140C4FACC;
dword_140C4FAD0 += 64;
ExReleaseRundownProtection((PEX_RUNDOWN_REF)&stru_140C4FA60);
LABEL_16:
if( v22 >= 0 )
{
v23 = *v17;
v24 = v110;
*((_DWORD *)v17 + 2) = v19;
v25 = v111;
*v17 = v23 & 0xFFFFFFFFFFFC0000ui64 | 0x2A013;
*((_OWORD *)v17 + 1) = v24;
*(_QWORD *)&v24 = v112;
*((_OWORD *)v17 + 2) = v25;
v17[6] = v24;
*((_QWORD *)&v16[1].Next + 1) += 64i64;
++*((_DWORD *)&v16[2].Next + 2);
Next = v16[1].Next;
if( (__int64)v16[2].Next - *((_QWORD *)&v16[1].Next + 1) < SLODWORD(Next[5].Next) )
{
((void(__fastcall *)(PSLIST_ENTRY))Next[6].Next)(v16);
}
else
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)&Next[2], v16);
ExReleaseRundownProtection((PEX_RUNDOWN_REF)Next);
}
v22 = 0;
goto LABEL_20;
}
}
else
{
LABEL_185:
v22 = -1073741431;
}
_InterlockedExchangeAdd((_DWORD *)&xmmword_140C4FC10 + 1, 1u);
if( v16 )
{
v93 = v16;
LABEL_188:
PfFbLogEntryComplete(v93, v20, 0i64);
}
LABEL_20:
if( v22 >= 0 )
return(unsigned int)v22;
goto LABEL_62;
}
v22 = -1073741697;
LABEL_62:
if( (int)v1[1] <= 3 )
++dword_140C4FC24;
return(unsigned int)v22;
}
switch( v4 )
{
case 0:
v58 = 2 * *(unsigned __int16 *)(*((_QWORD *)v1 + 2) + 30i64);
v41 = (v58 + 65) & 0xFFFFFFF8;
PfFbLogEntryReserve((INT64)&BufferList, &ListEntry, (INT64)&a3, v41, BugCheckParameter4, v95);
v22 = v59;
if( v59 < 0 )
goto LABEL_180;
v60 = a3;
*(_DWORD *)a3 = (8 * v41) | *(_DWORD *)a3 & 0x80000002 | 2;
*(_DWORD *)(v60 + 4) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 52i64);
*(_DWORD *)(v60 + 8) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 56i64);
*(_QWORD *)(v60 + 24) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 8i64);
*(_DWORD *)(v60 + 36) ^= (*(_DWORD *)(v60 + 36) ^ *(_DWORD *)(*((_QWORD *)v1 + 2) + 48i64)) & 0xF;
*(_DWORD *)(v60 + 36) ^= ((unsigned __int8)*(_DWORD *)(v60 + 36) ^ (unsigned __int8)*(_DWORD *)(*((_QWORD *)v1 + 2) + 48i64)) & 0xF0;
*(_QWORD *)(v60 + 16) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 16i64);
*(_DWORD *)(v60 + 32) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 24i64);
v61 = 2 * *(_WORD *)(*((_QWORD *)v1 + 2) + 30i64);
*(_WORD *)(v60 + 40) = v61;
*(_WORD *)(v60 + 42) = v61;
memmove((UINT8 *)(v60 + 56), *(UINT8 **)(*((_QWORD *)v1 + 2) + 40i64), v58);
v45 = (wchar_t *)(v60 + 56);
*(_WORD *)(v60 + 2i64 * *(unsigned __int16 *)(*((_QWORD *)v1 + 2) + 30i64) + 56) = 0;
goto LABEL_33;
case 1:
PfLogDeleteHelper(
2,
*(_QWORD *)(*((_QWORD *)v1 + 2) + 8i64),
*(unsigned int *)(*((_QWORD *)v1 + 2) + 56i64),
0i64);
return 0;
case 2:
v35 = *((_QWORD *)v1 + 2);
if( HIWORD(*(_DWORD *)(v35 + 32)) <= (unsigned int)(unsigned __int16)*(_DWORD *)(v35 + 32) )
return 0;
PfpRpFileKeyUpdate((INT64)&byte_140C50098, v35, 1i64);
if( dword_140C4FB20 >= (unsigned int)dword_140C4FB24 )
{
v22 = -1073741697;
goto LABEL_62;
}
v36 = *((_QWORD *)v1 + 2);
v37 = *(_DWORD *)(v36 + 32);
v38 = (UINT8 *)(*(_QWORD *)(v36 + 24) + 2i64 * (unsigned __int16)v37);
v39 = HIWORD(v37) - (unsigned __int16)v37;
v40 = 2 * v39;
v41 = (2 * v39 + 53) & 0xFFFFFFF8;
PfFbLogEntryReserve((INT64)&BufferList, &ListEntry, (INT64)&a3, v41, BugCheckParameter4, v95);
v22 = v42;
if( v42 >= 0 )
{
v43 = a3;
*(_DWORD *)a3 = *(_DWORD *)a3 & 0x80000000 | (8 * ((v40 + 53) & 0xFFFFFF8));
*(_DWORD *)(v43 + 4) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 40i64);
*(_DWORD *)(v43 + 8) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 44i64);
*(_QWORD *)(v43 + 24) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 8i64);
*(_DWORD *)(v43 + 32) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 48i64);
*(_QWORD *)(v43 + 16) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 16i64);
*(_DWORD *)(v43 + 40) ^= (*(_DWORD *)(v43 + 40) ^ *(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64)) & 1;
v44 = *(_DWORD *)(v43 + 40) ^ ((unsigned __int8)*(_DWORD *)(v43 + 40) ^ (unsigned __int8)(*(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64) >> 3)) & 2;
*(_DWORD *)(v43 + 40) = v44;
*(_DWORD *)(v43 + 40) = v44 ^ ((unsigned __int8)v44 ^ (unsigned __int8)(2
* *(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64))) & 4;
*(_WORD *)(v43 + 42) = v39;
memmove((UINT8 *)(v43 + 44), v38, v40);
v45 = (wchar_t *)(v43 + 44);
*(_WORD *)(v43 + 2i64 * *(unsigned __int16 *)(v43 + 42) + 44) = 0;
LABEL_33:
wcsupr(v45);
PfFbLogEntryComplete(ListEntry, v46, v41);
return 0;
}
LABEL_180:
v93 = ListEntry;
if( !ListEntry )
goto LABEL_20;
goto LABEL_188;
case 3:
v53 = *((_QWORD *)v1 + 2);
if( HIWORD(*(_DWORD *)(v53 + 32)) <= (unsigned int)(unsigned __int16)*(_DWORD *)(v53 + 32) )
return 0;
PfpRpFileKeyUpdate((INT64)&byte_140C50098, v53, 0i64);
if( dword_140C4FB20 < (unsigned int)dword_140C4FB24 )
{
PfLogDeleteHelper(
0,
*(_QWORD *)(*((_QWORD *)v1 + 2) + 16i64),
*(unsigned int *)(*((_QWORD *)v1 + 2) + 44i64),
(*(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64) >> 3) & 1);
return 0;
}
v22 = -1073741697;
goto LABEL_62;
case 8:
v55 = (int *)*((_QWORD *)v1 + 2);
v50 = (__int64 *)&v103;
v104 = 0;
v56 = *v55;
v103 = v55[1];
v105 = *((_QWORD *)v55 + 1);
v106 = (*((_QWORD *)v55 + 2) + 4095i64) & 0xFFFFFFFFFFFFF000ui64 | (2i64 * (v56 & 3));
v51 = ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24);
v52 = 24i64;
goto LABEL_52;
case 13:
v49 = (__int64 *)*((_QWORD *)v1 + 2);
if( !v49[1] )
{
v22 = -1073741747;
goto LABEL_62;
}
v107[1] = v49[1];
v50 = v107;
v108 = dword_140CEBED0;
v107[0] = *v49;
v109 = 0;
v51 = ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24);
v52 = 31i64;
LABEL_52:
PfLogEvent(v52, dword_140C5001C + (unsigned int)(v51 >> 10), v50, 0x18ui64);
v22 = 0;
break;
default:
goto LABEL_123;
}
return(unsigned int)v22;
}Referenced by:
No references.