PfpSourceGetPrefetchSupport

__int64 __fastcall PfpSourceGetPrefetchSupport(int *a1, __int64 a2){
  VOID *v2; 
  void *v3; 
  void *UniqueProcess; 
  int v6; 
  int v8; 
  unsigned __int64 v9; 
  NTSTATUS v10; 
  NTSTATUS v11; 
  __int64 v12; 
  UINT64 Tag; 
  PVOID Object; 
  void *ProcessHandle; 
  _CLIENT_ID ClientId; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _UNICODE_STRING DestinationString; 
  WCHAR pszDest[40]; 

  v2 = 0i64;
  *(_DWORD *)a2 = *a1;
  v3 = 0i64;
  Object = 0i64;
  UniqueProcess = 0i64;
  ProcessHandle = 0i64;
  ClientId.UniqueProcess = 0i64;
  v6 = *a1;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  if( !v6 )
  {
    *(_QWORD *)(a2 + 8) = 0i64;
    goto LABEL_9;
  }
  v8 = v6 - 1;
  if( !v8 )
  {
    RtlStringCbPrintfW(pszDest, 0x50ui64, (WCHAR *)L"\\KernelObjects\\Session%d");
    RtlInitUnicodeString(&DestinationString, pszDest);
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v10 = NtOpenSession(&ClientId.UniqueProcess, 0xF0003ui64, &ObjectAttributes);
    if( v10 < 0 )
    {
      UniqueProcess = ClientId.UniqueProcess;
      goto LABEL_22;
    }
    *(_QWORD *)(a2 + 8) = ClientId.UniqueProcess;
    goto LABEL_9;
  }
  if( v8 != 1 )
    return(unsigned int)-1073741637;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = 0i64;
  ClientId.UniqueThread = 0i64;
  v9 = (unsigned int)a1[1];
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ClientId.UniqueProcess = (void *)v9;
  v10 = NtOpenProcess(&ProcessHandle, 0x1FFFFF, &ObjectAttributes, &ClientId);
  if( v10 >= 0 )
  {
    v3 = ProcessHandle;
    LODWORD(Tag) = 1935107664;
    v11 = ObpReferenceObjectByHandleWithTag(
            ProcessHandle,
            0x1FFFFFui64,
            (_OBJECT_TYPE *)PsProcessType,
            0,
            Tag,
            &Object,
            0i64,
            0i64);
    v2 = Object;
    v10 = v11;
    if( v11 < 0 )
      goto LABEL_10;
    v12 = *((_QWORD *)a1 + 2);
    if( v12 && v12 != ((*((_QWORD *)Object + 136) ^ *((_QWORD *)Object + 141)) & 0x1FFFFFFFFFFFFFFFi64) )
    {
      v10 = -1073741275;
LABEL_10:
      if( v2 )
        ObfDereferenceObjectWithTag(v2, 0x73576650ui64);
      goto LABEL_12;
    }
    *(_QWORD *)(a2 + 8) = v3;
    v3 = 0i64;
LABEL_9:
    v10 = 0;
    goto LABEL_10;
  }
  v3 = ProcessHandle;
LABEL_12:
  if( !v3 )
    return(unsigned int)v10;
  NtClose((UINT64)v3);
LABEL_22:
  if( UniqueProcess )
    NtClose((UINT64)UniqueProcess);
  return(unsigned int)v10;
}

Referenced by: