FsRtlpHeatRegisterVolume

INT64 __stdcall FsRtlpHeatRegisterVolume(GUID *VolumeGuid, GUID *ActivityId, UINT64 *VolumeIdHash){
  BOOL(__fastcall *i)(INT64, struct KPRCB *); 
  __int64 v7; 
  char *PoolWithTag; 
  int v9; 
  BOOL(__fastcall *v10)(INT64, struct KPRCB *); 
  INT64 v11; 
  GUID v12; 
  BOOL(__fastcall **v13)(INT64, struct KPRCB *); 
  INT64 v14; 
  INT64 v15; 
  INT64 v17; 
  ExAcquireResourceExclusiveLite(&Resource, 1u);
  for( i = *(BOOL(__fastcall **)(INT64, struct KPRCB *))FsRtlTieringHeatData;
        i != FsRtlTieringHeatData;
        i = *(BOOL(__fastcall **)(INT64, struct KPRCB *))i )
  {
    v7 = *(_QWORD *)((char *)i + 20) - *(_QWORD *)&VolumeGuid->Data1;
    if( !v7 )
      v7 = *(_QWORD *)((char *)i + 28) - *(_QWORD *)VolumeGuid->Data4;
    if( !v7 )
    {
      ++*((_DWORD *)i + 4);
      *(_DWORD *)VolumeIdHash = *((_DWORD *)i + 9);
      goto LABEL_20;
    }
  }
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x68745346ui64);
  if( !PoolWithTag )
  {
    v9 = -1073741670;
    goto LABEL_21;
  }
  v10 = *(BOOL(__fastcall **)(INT64, struct KPRCB *))FsRtlTieringHeatData;
  v11 = VolumeGuid->Data1 ^ (VolumeGuid->Data3 | (VolumeGuid->Data2 << 16)) ^ (VolumeGuid->Data4[7] | (VolumeGuid->Data4[2] << 24));
  while( v10 != FsRtlTieringHeatData )
  {
    if( *((_DWORD *)v10 + 9) == (_DWORD)v11 )
    {
      v11 = (unsigned int)(v11 + 1);
      if( !(_DWORD)v11 )
        v10 = FsRtlTieringHeatData;
    }
    else if( *((_DWORD *)v10 + 9) > (unsigned int)v11 )
    {
      break;
    }
    v10 = *(BOOL(__fastcall **)(INT64, struct KPRCB *))v10;
  }
  *(_OWORD *)PoolWithTag = 0i64;
  *((_OWORD *)PoolWithTag + 1) = 0i64;
  *((_QWORD *)PoolWithTag + 4) = 0i64;
  v12 = *VolumeGuid;
  *((_DWORD *)PoolWithTag + 9) = v11;
  *((_DWORD *)PoolWithTag + 4) = 1;
  *(GUID *)(PoolWithTag + 20) = v12;
  v13 = (BOOL(__fastcall **)(INT64, struct KPRCB *))*((_QWORD *)v10 + 1);
  if( *v13 != v10 )
    __fastfail(3u);
  *((_QWORD *)PoolWithTag + 1) = v13;
  *(_QWORD *)PoolWithTag = v10;
  *v13 = (BOOL(__fastcall *)(INT64, struct KPRCB *))PoolWithTag;
  *((_QWORD *)v10 + 1) = PoolWithTag;
  *(_DWORD *)VolumeIdHash = v11;
  McGenEventRegister_EtwRegister(
    &MS_StorageTiering_Provider,
    v11,
    &MS_StorageTiering_Provider_Context,
    &MS_StorageTiering_Provider_Context.RegistrationHandle);
LABEL_20:
  v9 = 0;
LABEL_21:
  ExReleaseResourceLite(&Resource);
  if( v9 >= 0 )
  {
    if( (Microsoft_Windows_Storage_Tiering_IoHeatEnableBits & 1) != 0 )
    {
      LODWORD(v17) = *(_DWORD *)VolumeIdHash;
      McTemplateK0jq_EtwWriteTransfer(v15, v14, ActivityId, (INT64)VolumeGuid, v17);
    }
    ZwUpdateWnfStateData();
  }
  return(unsigned int)v9;
}

Referenced by: