PfpRpFileKeyUpdate
NTSTATUS __stdcall PfpRpFileKeyUpdate(PFPRP_CONTEXT *Context, PFFI_FILEINFO_STREAM_INFO *StreamInfo, UINT64 Create){
NTSTATUS v3;
int v4;
PFPRP_CONTEXT v5;
void *v8;
_QWORD *v9;
unsigned int v10;
WCHAR *v11;
__int64 v12;
__int64 v13;
WCHAR *j;
unsigned __int8 v15;
_ETHREAD *CurrentThread;
unsigned int v17;
__int64 v18;
UINT64 v19;
__int64 v20;
VOID **v21;
unsigned int v22;
char v23;
unsigned __int64 v24;
VOID ***v25;
unsigned __int64 v27;
_QWORD *i;
_QWORD *v29;
void *v30;
VOID *Buckets;
unsigned __int64 v32;
unsigned __int64 v33;
unsigned __int64 v34;
_EX_RUNDOWN_REF *RunRef;
unsigned int BucketCount;
VOID **P;
unsigned __int64 v38;
v3 = 0;
v38 = *((_QWORD *)StreamInfo + 2);
v4 = Create;
v5 = Context[38];
P = 0i64;
Buckets = 0i64;
v8 = 0i64;
BucketCount = 0;
v9 = 0i64;
if( (v5 & 1) == 0 )
return -1073741696;
RunRef = (_EX_RUNDOWN_REF *)(Context + 34);
if( !ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Context + 17) )
return -1073741696;
if( !v4 )
{
v13 = 0i64;
LABEL_9:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Context + 6, 0i64);
if( v4 )
{
v17 = (unsigned int)Context[1] >> 5;
v18 = -1i64 << (Context[1] & 0x1F);
v19 = v38 & v18;
v34 = (v38 & v18) >> 32;
v33 = (v38 & v18) >> 24;
v32 = (v38 & v18) >> 16;
if( v17 )
{
v20 = *((_QWORD *)Context + 1)
+ 8
* ((((v38 & v18) >> 56)
+ 37
* ((unsigned __int8)((v38 & v18) >> 48)
+ 37
* ((unsigned __int8)((unsigned __int16)((v38 & v18) >> 32) >> 8)
+ 37
* ((unsigned __int8)v34
+ 37
* ((unsigned __int8)v33
+ 37
* ((unsigned __int8)v32
+ 37
* ((unsigned __int8)((unsigned __int16)(v38 & v18) >> 8)
+ 37 * ((unsigned int)(unsigned __int8)v19 + 11623883)))))))) & (v17 - 1));
while( 1 )
{
v20 = *(_QWORD *)v20;
if( (v20 & 1) != 0 )
break;
if( v19 == (v18 & *(_QWORD *)(v20 + 8)) )
{
*(_QWORD *)(v20 + 16) = v13;
goto LABEL_15;
}
}
}
*P = 0i64;
P[1] = (VOID *)v38;
P[2] = (VOID *)v13;
if( (unsigned int)PfpRpRehashIfNeeded((_RTL_HASH_TABLE *)Context, &Buckets, BucketCount, v19) )
{
v22 = Context[1];
v21 = 0i64;
v23 = v22 & 0x1F;
v24 = (unsigned __int64)P[1] & (-1i64 << (v22 & 0x1F));
v25 = (VOID ***)(*((_QWORD *)Context + 1)
+ 8
* ((HIBYTE(v24)
+ 37
* ((unsigned __int8)(((unsigned __int64)P[1] & (-1i64 << v23)) >> 48)
+ 37
* ((unsigned __int8)((unsigned __int16)(((unsigned __int64)P[1] & (-1i64 << v23)) >> 32) >> 8)
+ 37
* ((unsigned __int8)(((unsigned __int64)P[1] & (-1i64 << v23)) >> 32)
+ 37
* ((((_DWORD)P[1] & (unsigned int)(-1 << v23)) >> 24)
+ 37
* ((unsigned __int8)(((_DWORD)P[1] & (unsigned int)(-1 << v23)) >> 16)
+ 37
* (37 * ((unsigned __int8)v24 + 11623883)
+ (unsigned __int8)((unsigned __int16)((_WORD)P[1] & (-1 << v23)) >> 8)))))))) & ((v22 >> 5) - 1)));
*P = *v25;
*v25 = P;
++*Context;
}
else
{
v3 = -1073741670;
v21 = P;
}
}
else
{
LABEL_28:
if( *Context )
{
v27 = v38 & (-1i64 << (Context[1] & 0x1F));
for( i = (_QWORD *)(*((_QWORD *)Context + 1)
+ 8
* ((37
* (BYTE6(v27)
+ 37
* (BYTE5(v27)
+ 37
* (BYTE4(v27)
+ 37
* ((((unsigned int)v38 & (-1 << (Context[1] & 0x1F))) >> 24)
+ 37
* ((unsigned __int8)(((unsigned int)v38 & (-1 << (Context[1] & 0x1F))) >> 16)
+ 37
* ((unsigned __int8)((unsigned __int16)(v38 & (-1 << (Context[1] & 0x1F))) >> 8)
+ 37 * ((unsigned __int8)v27 + 11623883)))))))
+ HIBYTE(v27)) & (((unsigned int)Context[1] >> 5) - 1))); ; i = (_QWORD *)*i )
{
v29 = (_QWORD *)*i;
if( (*i & 1) != 0 )
break;
if( ((-1i64 << (Context[1] & 0x1F)) & v29[1]) == v27 )
{
*i = *v29;
--*Context;
*v29 |= 0x8000000000000002ui64;
if( *((_QWORD **)Context + 2) == v29 )
*((_QWORD *)Context + 2) = Context + 6;
*v29 = v9;
v9 = v29;
goto LABEL_28;
}
}
}
LABEL_15:
v21 = P;
}
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)Context + 6, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)Context + 6);
KeAbPostRelease(Context + 12);
KeLeaveCriticalRegion();
v8 = Buckets;
goto LABEL_21;
}
P = ExAllocatePoolWithTag(1ui64, 0x18ui64, 1262904912i64);
if( P )
{
v10 = 2 * ((unsigned int)Context[1] >> 5);
if( *Context >= v10 )
{
BucketCount = 2 * ((unsigned int)Context[1] >> 5);
if( !v10 )
{
v10 = 64;
BucketCount = 64;
}
Buckets = ExAllocatePoolWithTag(1ui64, 8i64 * v10, 1212573264i64);
v8 = Buckets;
if( !Buckets )
BucketCount = 0;
}
v11 = (WCHAR *)*((_QWORD *)StreamInfo + 3);
v12 = *((unsigned __int16 *)StreamInfo + 17);
v13 = 314159i64;
for( j = &v11[v12]; v11 < j; v13 = 37 * (v15 + 37 * v13) )
v15 = (unsigned __int8)RtlUpcaseUnicodeChar(*v11++);
if( v13 )
goto LABEL_9;
v21 = P;
v3 = -1073741747;
}
else
{
v3 = -1073741670;
v21 = 0i64;
}
LABEL_21:
ExReleaseRundownProtection(RunRef);
if( v21 )
ExFreePoolWithTag(v21, 0);
while( v9 )
{
v30 = v9;
v9 = (_QWORD *)*v9;
ExFreePoolWithTag(v30, 0);
}
if( v8 )
ExFreePoolWithTag(v8, 0);
return v3;
}Referenced by:
PfFileInfoNotify