PfFbLogEntryReserve
VOID __stdcall PfFbLogEntryReserve(
INT64 BufferList,
_BYTE *BufferOut,
INT64 a3,
INT64 a4,
VOID **LogEntryOut,
UINT64 Size){
__int64 v6;
INT64 v9;
PSLIST_ENTRY v10;
__int64 v11;
v6 = (unsigned int)a4;
v9 = BufferList;
while( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)BufferList) )
{
while( 1 )
{
v10 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)(v9 + 32));
if( v10 )
break;
v10 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)(v9 + 16));
if( v10 )
break;
if( (*(int(__fastcall **)(INT64))(v9 + 88))(v9) < 0 )
goto LABEL_9;
}
v11 = *((_QWORD *)&v10[1].Next + 1);
if( v6 <= (__int64)v10[2].Next - v11 )
{
*(_QWORD *)a3 = v11;
*(_QWORD *)BufferOut = v10;
return;
}
if( !*((_DWORD *)&v10[2].Next + 2) )
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)(v9 + 16), v10);
LABEL_9:
++*(_DWORD *)(v9 + 108);
*(_DWORD *)(v9 + 112) += v6;
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)v9);
return;
}
(*(void(__fastcall **)(PSLIST_ENTRY))(v9 + 96))(v10);
BufferList = v9;
}
}Referenced by:
PfFileInfoNotify
PfLogDeleteHelper
PfLogEvent