PfSnLogVolumeCreate

__int64 __fastcall PfSnLogVolumeCreate(__int64 a1){
  int v1; 
  unsigned int v2; 
  __int64 v4; 
  int v5; 
  struct _EX_RUNDOWN_REF *v6; 
  __int64 *v7; 
  unsigned __int64 v8; 
  int v9; 
  UNICODE_STRING SourceString; 
  struct _UNICODE_STRING DestinationString; 
  __int64 *v13; 
  v1 = *(unsigned __int16 *)(a1 + 30);
  v2 = 0;
  v4 = *(_QWORD *)a1;
  v5 = 2 * v1;
  *(_DWORD *)(&DestinationString.MaximumLength + 1) = 0;
  *(_DWORD *)(&SourceString.MaximumLength + 1) = 0;
  v13 = 0i64;
  v6 = PfSnLogHelper(v4, (unsigned int)(v5 + 97) >> 4, &v13);
  if( v6 )
  {
    v7 = v13;
    DestinationString.Length = 0;
    DestinationString.MaximumLength = v5;
    *(_OWORD *)v13 = 0i64;
    *v7 = (8i64 * (((unsigned int)(v5 + 97) >> 4) - 1)) | 5;
    v8 = ((unsigned __int64)v7 + 23) & 0xFFFFFFFFFFFFFFF8ui64;
    v7[1] = *(_QWORD *)(a1 + 8);
    SourceString.Length = v5;
    SourceString.MaximumLength = v5;
    *(_QWORD *)v8 = 0i64;
    v9 = *(_DWORD *)(v8 + 36);
    DestinationString.Buffer = (wchar_t *)(v8 + 56);
    SourceString.Buffer = *(wchar_t **)(a1 + 40);
    *(_DWORD *)v8 = (8 * v5 + 528) | 2;
    *(_DWORD *)(v8 + 4) = *(_DWORD *)(a1 + 52);
    *(_DWORD *)(v8 + 8) = *(_DWORD *)(a1 + 56);
    *(_QWORD *)(v8 + 24) = *(_QWORD *)(a1 + 8);
    *(_DWORD *)(v8 + 36) ^= (*(_DWORD *)(a1 + 48) ^ v9) & 0xF;
    *(_DWORD *)(v8 + 36) ^= (*(_DWORD *)(a1 + 48) ^ *(_DWORD *)(v8 + 36)) & 0xF0;
    *(_QWORD *)(v8 + 16) = *(_QWORD *)(a1 + 16);
    *(_DWORD *)(v8 + 32) = *(_DWORD *)(a1 + 24);
    *(_WORD *)(v8 + 40) = v5;
    *(_WORD *)(v8 + 42) = v5;
    RtlUpcaseUnicodeString(&DestinationString, &SourceString, 0);
    *(_WORD *)(v8 + 2i64 * *(unsigned __int16 *)(a1 + 30) + 56) = 0;
    ExReleaseRundownProtection(v6 + 45);
  }
  else
  {
    return(unsigned int)-1073741446;
  }
  return v2;
}

Referenced by: