PfSnLogStreamCreate

INT64 __fastcall PfSnLogStreamCreate(INT64 a1){
  unsigned int v1; 
  unsigned int v2; 
  unsigned int v4; 
  __int64 v5; 
  unsigned __int64 v6; 
  struct _EX_RUNDOWN_REF *v7; 
  __int64 *v8; 
  unsigned __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  UNICODE_STRING SourceString; 
  struct _UNICODE_STRING DestinationString; 
  __int64 *v15; 
  v1 = 0;
  v2 = *(unsigned __int16 *)(a1 + 34);
  v4 = (unsigned __int16)*(_DWORD *)(a1 + 32);
  *(_DWORD *)(&DestinationString.MaximumLength + 1) = 0;
  *(_DWORD *)(&SourceString.MaximumLength + 1) = 0;
  v15 = 0i64;
  if( v2 <= v4 )
  {
    return(unsigned int)-1073741637;
  }
  else
  {
    v5 = v2 - v4;
    v6 = ((unsigned __int64)(unsigned int)(2 * v5 + 70) + 15) >> 4;
    v7 = PfSnLogHelper(*(_QWORD *)a1, (unsigned int)v6, &v15);
    if( v7 )
    {
      v8 = v15;
      DestinationString.Length = 0;
      *(_OWORD *)v15 = 0i64;
      *v8 = (8i64 * (unsigned int)(v6 - 1)) | 5;
      v9 = ((unsigned __int64)v8 + 23) & 0xFFFFFFFFFFFFFFF8ui64;
      v8[1] = *(_QWORD *)(a1 + 16);
      *(_QWORD *)v9 = 0i64;
      DestinationString.Buffer = (wchar_t *)(v9 + 44);
      v10 = (unsigned __int16)*(_DWORD *)(a1 + 32);
      v11 = *(_QWORD *)(a1 + 24);
      DestinationString.MaximumLength = 2 * v5;
      SourceString.Length = 2 * v5;
      SourceString.MaximumLength = 2 * v5;
      SourceString.Buffer = (wchar_t *)(v11 + 2 * v10);
      LODWORD(v10) = *(_DWORD *)(v9 + 40);
      *(_DWORD *)v9 = 8 * ((2 * v5 + 54) & 0xFFFFFFF);
      *(_DWORD *)(v9 + 4) = *(_DWORD *)(a1 + 40);
      *(_DWORD *)(v9 + 8) = *(_DWORD *)(a1 + 44);
      *(_QWORD *)(v9 + 24) = *(_QWORD *)(a1 + 8);
      *(_DWORD *)(v9 + 32) = *(_DWORD *)(a1 + 48);
      *(_QWORD *)(v9 + 16) = *(_QWORD *)(a1 + 16);
      *(_DWORD *)(v9 + 40) ^= (*(_DWORD *)(a1 + 36) ^ v10) & 1;
      *(_DWORD *)(v9 + 40) ^= ((unsigned __int8)*(_DWORD *)(v9 + 40) ^ (unsigned __int8)(2 * *(_DWORD *)(a1 + 36))) & 4;
      *(_WORD *)(v9 + 42) = v5;
      RtlUpcaseUnicodeString(&DestinationString, &SourceString, 0);
      *(_WORD *)(v9 + 2 * v5 + 44) = 0;
      ExReleaseRundownProtection(v7 + 45);
    }
    else
    {
      return(unsigned int)-1073741446;
    }
  }
  return v1;
}

Referenced by: