PfSnPrefetchMetadata

NTSTATUS __stdcall PfSnPrefetchMetadata(PFSN_PREFETCH_HEADER *PrefetchHeader, UINT64 PhaseMask){
  __int64 v2; 
  int v3; 
  int v5; 
  int Event; 
  __int64 v7; 
  __int64 v8; 
  PFSN_PREFETCH_HEADER *v9; 
  unsigned int *v10; 
  __int64 *PrefetchVolumeInfoInList; 
  __int64 *v12; 
  _DWORD *v13; 
  unsigned int i; 
  __int64 v15; 
  PFSN_PREFETCH_HEADER v16; 
  int v17; 
  unsigned int v18; 
  _QWORD *v19; 
  unsigned int v20; 
  unsigned __int16 *v21; 
  unsigned int v22; 
  int v23; 
  unsigned int *v24; 
  UINT64 v25; 
  unsigned int v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30; 
  __int64 v31; 
  UINT64 RecordsToPrefetch; 
  __int128 v33; 
  __int64 v34; 
  INT64 v35; 
  __int64 v36; 
  _UNICODE_STRING *v37; 
  int v38; 
  int v39; 
  __int128 v40; 
  __int64 v41; 
  __int64 v42; 
  __int64 v43; 
  _UNICODE_STRING DestinationString[5]; 
  unsigned int v45; 
  int v46; 
  int v47; 
  VOID *Handle; 

  v46 = PhaseMask;
  v2 = *(_QWORD *)PrefetchHeader;
  v3 = 0;
  HIDWORD(v35) = 0;
  v39 = 0;
  v42 = v2;
  Handle = 0i64;
  v34 = 0i64;
  v5 = PhaseMask;
  DestinationString[0] = 0i64;
  v33 = 0i64;
  PfSnLogPrefetchMetadata(v2, PhaseMask, 1);
  if( v2 )
  {
    LODWORD(v35) = 48;
    v36 = 0i64;
    v38 = 512;
    v37 = 0i64;
    v40 = 0i64;
    Event = NtCreateEvent((UINT64)&Handle, 0x1F0003ui64, (INT64)&v35, 0i64, 0);
    if( Event >= 0 )
    {
      v7 = v2 + *(unsigned int *)(v2 + 108);
      v8 = 0i64;
      v43 = v7;
      v47 = 0;
      if( *(_DWORD *)(v2 + 112) )
      {
        v9 = PrefetchHeader + 10;
        do
        {
          v10 = (unsigned int *)(v7 + 96 * v8);
          PrefetchVolumeInfoInList = PfSnFindPrefetchVolumeInfoInList((WCHAR *)(v7 + *v10), v9, 1);
          v12 = PrefetchVolumeInfoInList;
          if( PrefetchVolumeInfoInList && (*((_DWORD *)PrefetchVolumeInfoInList + 27) & 1) != 0 )
          {
            v13 = v10 + 9;
            for( i = 0; i < 7; ++i )
            {
              if( _bittest(&v5, i) )
                v3 += *v13 + v13[7];
              ++v13;
            }
            LODWORD(RecordsToPrefetch) = v3;
            PfSnPrefetchFileMetadata(
              PrefetchHeader,
              (VOID *)PrefetchVolumeInfoInList[4],
              (_FILE_PREFETCH_EX *)(v7 + v10[5]),
              *((unsigned int *)PrefetchVolumeInfoInList + 26),
              RecordsToPrefetch,
              Handle);
            *((_DWORD *)v12 + 26) += v3;
            v15 = *((_QWORD *)PrefetchHeader + 10);
            v41 = v15;
            *(_DWORD *)v15 = 4;
            v16 = PrefetchHeader[24];
            v17 = PrefetchHeader[25] & 7 | 8;
            *(_DWORD *)(v15 + 4) = 768;
            *(_QWORD *)(v15 + 8) = v16 & 7 | (unsigned __int64)(unsigned int)(8 * v17);
            v18 = 0;
            v19 = (_QWORD *)(v15 + 16);
            do
            {
              v20 = v18++;
              *v19++ = v20 << 12;
            }
            while( v18 < 0x300 );
            v21 = (unsigned __int16 *)v12[12];
            v22 = 0;
            v23 = v46;
            v24 = v10 + 16;
            v25 = v41;
            v45 = 0;
            do
            {
              if( _bittest(&v23, v22) )
              {
                v27 = 0;
                if( *v24 )
                {
                  do
                  {
                    RtlInitUnicodeString(DestinationString, &v21[*((unsigned int *)v12 + 6) + 2]);
                    v28 = *((_QWORD *)PrefetchHeader + 1);
                    v36 = v12[8];
                    LODWORD(v35) = 48;
                    v37 = DestinationString;
                    v38 = 576;
                    v34 = 0i64;
                    v40 = 0i64;
                    v33 = 0i64;
                    PfpPrefetchEntireDirectory(v28, (__int64)(v12 + 4), v25, (__int64)&v33, (__int64)&v35);
                    if( (_QWORD)v33 && PrefetchHeader[30] < (unsigned int)PrefetchHeader[31] )
                    {
                      v29 = v34;
                      v30 = 3i64 * (unsigned int)PrefetchHeader[30];
                      v31 = *((_QWORD *)PrefetchHeader + 14);
                      *(_OWORD *)(v31 + 8 * v30) = v33;
                      *(_QWORD *)(v31 + 8 * v30 + 16) = v29;
                      ++PrefetchHeader[30];
                    }
                    ++v27;
                    v21 += *v21 + 2;
                  }
                  while( v27 < *v24 );
                  v22 = v45;
                  v23 = v46;
                }
              }
              ++v22;
              ++v24;
              v45 = v22;
            }
            while( v22 < 7 );
            v2 = v42;
            v3 = 0;
            v7 = v43;
            v12[12] = (__int64)v21;
            v5 = v46;
          }
          v9 = PrefetchHeader + 10;
          v8 = (unsigned int)(v47 + 1);
          v47 = v8;
        }
        while( (unsigned int)v8 < *(_DWORD *)(v2 + 112) );
      }
      Event = 0;
    }
    if( Handle )
      NtClose((UINT64)Handle);
  }
  else
  {
    Event = -1073741811;
  }
  PfSnLogPrefetchMetadata(v2, v5, 0);
  return Event;
}

Referenced by: