PfSnLogVolumeCreate

NTSTATUS __stdcall PfSnLogVolumeCreate(_PFFI_FILEINFO_VOLUME_INFO *VolumeCreateEvent){
  int v1; 
  NTSTATUS v2; 
  _EPROCESS *v4; 
  int v5; 
  _EX_RUNDOWN_REF *v6; 
  __int64 *v7; 
  unsigned __int64 v8; 
  int v9; 
  _UNICODE_STRING SourceString; 
  _UNICODE_STRING DestinationString; 
  __int64 *v13; 

  v1 = *((unsigned __int16 *)VolumeCreateEvent + 15);
  v2 = 0;
  v4 = *(_EPROCESS **)VolumeCreateEvent;
  v5 = 2 * v1;
  *(_DWORD *)(&DestinationString.MaximumLength + 1) = 0;
  *(_DWORD *)(&SourceString.MaximumLength + 1) = 0;
  v13 = 0i64;
  v6 = PfSnLogHelper(v4, (unsigned int)(v5 + 97) >> 4, &v13);
  if( !v6 )
    return -1073741446;
  v7 = v13;
  DestinationString.Length = 0;
  DestinationString.MaximumLength = v5;
  *(_OWORD *)v13 = 0i64;
  *v7 = (8i64 * (((unsigned int)(v5 + 97) >> 4) - 1)) | 5;
  v8 = ((unsigned __int64)v7 + 23) & 0xFFFFFFFFFFFFFFF8ui64;
  v7[1] = *((_QWORD *)VolumeCreateEvent + 1);
  SourceString.Length = v5;
  SourceString.MaximumLength = v5;
  *(_QWORD *)v8 = 0i64;
  v9 = *(_DWORD *)(v8 + 36);
  DestinationString.Buffer = (wchar_t *)(v8 + 56);
  SourceString.Buffer = (wchar_t *)*((_QWORD *)VolumeCreateEvent + 5);
  *(_DWORD *)v8 = (8 * v5 + 528) | 2;
  *(_DWORD *)(v8 + 4) = VolumeCreateEvent[13];
  *(_DWORD *)(v8 + 8) = VolumeCreateEvent[14];
  *(_QWORD *)(v8 + 24) = *((_QWORD *)VolumeCreateEvent + 1);
  *(_DWORD *)(v8 + 36) ^= (VolumeCreateEvent[12] ^ v9) & 0xF;
  *(_DWORD *)(v8 + 36) ^= (VolumeCreateEvent[12] ^ *(_DWORD *)(v8 + 36)) & 0xF0;
  *(_QWORD *)(v8 + 16) = *((_QWORD *)VolumeCreateEvent + 2);
  *(_DWORD *)(v8 + 32) = VolumeCreateEvent[6];
  *(_WORD *)(v8 + 40) = v5;
  *(_WORD *)(v8 + 42) = v5;
  RtlUpcaseUnicodeString(&DestinationString, &SourceString, 0);
  *(_WORD *)(v8 + 2i64 * *((unsigned __int16 *)VolumeCreateEvent + 15) + 56) = 0;
  ExReleaseRundownProtection(v6 + 45);
  return v2;
}

Referenced by: