PfSnGetSectionObject

NTSTATUS __stdcall PfSnGetSectionObject(
        PFSN_PREFETCH_HEADER *PrefetchHeader,
        PFSN_PREFETCH_VOLUME_INFO *VolumeNode,
        VOID *FilePath,
        PF_SECTION_RECORD *SectionRecord,
        UINT64 PrefetchPhaseMask,
        UINT64 SectionIdx,
        UINT64 ImageSection,
        VOID *EventHandle,
        _FILE_OBJECT **OutFileObject,
        _BYTE *NeedToCleanup){
  __int128 v11; 
  __int64 v12; 
  VOID *v15; 
  __int64 v16; 
  int v17; 
  __int64 v18; 
  NTSTATUS Section; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int128 v23; 
  NTSTATUS v24; 
  _ADAPTER_OBJECT *v25; 
  PF_SECTION_RECORD *v26; 
  unsigned int v27; 
  unsigned int v28; 
  __int64 v29; 
  unsigned int v30; 
  NTSTATUS v31; 
  unsigned __int8 v32; 
  int v34; 
  ULONGLONG v35; 
  VOID *Information; 
  UINT64 *ReturnedLength; 
  VOID *SectionHandle; 
  PVOID Object; 
  int v40; 
  __int64 v41; 
  __m256i FileHandle; 
  UINT64 v43; 
  _FILE_OBJECT **v44; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _FILE_PREFETCH_EX FilePrefetch; 

  v11 = 0i64;
  Object = FilePath;
  v12 = 0x200000000i64;
  *OutFileObject = 0i64;
  FilePrefetch.Prefetch[0] = 0i64;
  v44 = OutFileObject;
  v15 = 0i64;
  *NeedToCleanup = 0;
  v16 = *(_QWORD *)PrefetchHeader;
  *(&ObjectAttributes.Length + 1) = 0;
  v17 = (_DWORD)ImageSection != 0 ? 285212672 : 0x4000000;
  *(&ObjectAttributes.Attributes + 1) = 0;
  *(_OWORD *)&FilePrefetch.Type = 0i64;
  v41 = 0i64;
  memset(&FileHandle, 0, 24);
  FileHandle.m256i_i64[3] = 0x200000000i64;
  SectionHandle = 0i64;
  v40 = v17;
  if( (unsigned int)SectionIdx >= *(_DWORD *)(v16 + 88) )
  {
    Section = -1073741811;
    goto LABEL_27;
  }
  v18 = *((_QWORD *)PrefetchHeader + 7) + 56i64 * (unsigned int)SectionIdx;
  if( (*(_QWORD *)(v18 + 24) & 0x400000000i64) == 0 )
  {
    if( (VolumeNode[27] & 1) == 0 )
    {
      v35 = *((_QWORD *)SectionRecord + 3);
      FilePrefetch.Context = 0i64;
      FilePrefetch.Prefetch[0] = v35;
      FilePrefetch.Type = 3;
      FilePrefetch.Count = 1;
      if( v35 )
      {
        LODWORD(Information) = 1;
        PfSnPrefetchFileMetadata(
          PrefetchHeader,
          *((VOID **)VolumeNode + 4),
          &FilePrefetch,
          0i64,
          (UINT64)Information,
          EventHandle);
      }
    }
    Section = PfpOpenHandleCreate(
                (__int64)&FileHandle,
                *((_QWORD *)PrefetchHeader + 1),
                (__int64)Object,
                *((_QWORD *)VolumeNode + 8),
                161,
                0x40u,
                0x80u,
                (__int64)(VolumeNode + 8));
    if( Section < 0 || (Section = PfpFileCheckAttributesForPrefetch((VOID *)FileHandle.m256i_i64[0]), Section < 0) )
    {
      v12 = FileHandle.m256i_i64[3];
      goto LABEL_27;
    }
    if( PrefetchHeader[30] < (unsigned int)PrefetchHeader[31]
      && IopQueryXxxInformation((PVOID)FileHandle.m256i_i64[1], 6ui64, 8ui64, 0, &v41, &v43, 1u) >= 0 )
    {
      v20 = (unsigned int)_InterlockedExchangeAdd(PrefetchHeader + 30, 1u);
      v21 = *((_QWORD *)PrefetchHeader + 14);
      v22 = 3 * v20;
      *(_QWORD *)(v21 + 8 * v22 + 12) = v41;
      LODWORD(v20) = FileHandle.m256i_i32[6];
      *(_QWORD *)(v21 + 8 * v22) = *(_QWORD *)(FileHandle.m256i_i64[1] + 24);
      *(_DWORD *)(v21 + 8 * v22 + 8) = v20;
    }
    v15 = SectionHandle;
    v23 = *(_OWORD *)&FileHandle.m256i_u64[2];
    v17 = v40;
    *(_OWORD *)v18 = *(_OWORD *)FileHandle.m256i_i8;
    memset(&FileHandle, 0, 24);
    v11 = 0i64;
    FileHandle.m256i_i64[3] = 0x200000000i64;
    *(_OWORD *)(v18 + 16) = v23;
  }
  if( (_DWORD)ImageSection )
  {
    if( *(_QWORD *)(v18 + 32) )
    {
      v27 = PrefetchPhaseMask;
      v26 = SectionRecord;
      goto LABEL_33;
    }
  }
  else if( *(_QWORD *)(v18 + 40) )
  {
    if( !PfSnIsSectionPrefetchedAfterPhase((__int64)SectionRecord, 0, PrefetchPhaseMask) )
      goto LABEL_16;
LABEL_17:
    *v44 = *(_FILE_OBJECT **)(v18 + 8);
    if( !PfSnIsSectionPrefetchedAfterPhase((__int64)SectionRecord, 1, v28)
      && !PfSnIsSectionPrefetchedAfterPhase((__int64)SectionRecord, 0, v30)
      && ((v32 & (unsigned __int8)BYTE1(SectionRecord[5]) & 0x7F) == 0 || (_DWORD)ImageSection != v31) )
    {
      *(_DWORD *)(v18 + 48) |= 4u;
    }
    Section = v31;
    goto LABEL_23;
  }
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = v11;
  LODWORD(ReturnedLength) = v17;
  LODWORD(Information) = 2;
  Section = NtCreateSection(
              (UINT64)&SectionHandle,
              5ui64,
              (INT64)&ObjectAttributes,
              0i64,
              (INT64)Information,
              (INT64)ReturnedLength,
              *(_QWORD *)v18);
  if( Section >= 0 )
  {
    v15 = SectionHandle;
    Object = 0i64;
    v24 = ObReferenceObjectByHandle(SectionHandle, 5ui64, MmSectionObjectType, 0, &Object, 0i64);
    v25 = (_ADAPTER_OBJECT *)Object;
    Section = v24;
    if( v24 < 0 )
    {
LABEL_23:
      if( v25 )
        HalPutDmaAdapter(v25);
      goto LABEL_25;
    }
    v26 = SectionRecord;
    v27 = PrefetchPhaseMask;
    if( !(_DWORD)ImageSection )
    {
      *(_QWORD *)(v18 + 40) = Object;
      if( !PfSnIsSectionPrefetchedAfterPhase((__int64)SectionRecord, 0, PrefetchPhaseMask) )
      {
LABEL_16:
        *(_DWORD *)(v18 + 48) |= 2u;
        *NeedToCleanup = 1;
        goto LABEL_17;
      }
      if( *(_QWORD *)(v18 + 32) != v29
        || !PfSnIsSectionPrefetchedAfterPhase((__int64)SectionRecord, 1, v28)
        && ((unsigned __int8)v28 & (unsigned __int8)BYTE1(SectionRecord[5]) & 0x7F) == 0 )
      {
        goto LABEL_17;
      }
      *(_DWORD *)(v18 + 48) |= 2u;
LABEL_35:
      *NeedToCleanup = v34;
      goto LABEL_17;
    }
    *(_QWORD *)(v18 + 32) = Object;
LABEL_33:
    if( PfSnIsSectionPrefetchedAfterPhase((__int64)v26, 1, v27) )
      goto LABEL_17;
    *(_DWORD *)(v18 + 48) |= v34;
    goto LABEL_35;
  }
  v15 = SectionHandle;
LABEL_25:
  if( v15 )
    NtClose((UINT64)v15);
LABEL_27:
  if( (v12 & 0x400000000i64) != 0 )
    PfpOpenHandleClose(&FileHandle, *((_QWORD *)PrefetchHeader + 1));
  return Section;
}

Referenced by: