FsRtlpHeatRegisterVolume

NTSTATUS __stdcall FsRtlpHeatRegisterVolume(_GUID *VolumeGuid, _GUID *ActivityId, UINT64 *VolumeIdHash){
  __int64 *i; 
  __int64 v7; 
  VOID **PoolWithTag; 
  NTSTATUS v9; 
  VOID **v10; 
  __int64 v11; 
  _GUID v12; 
  VOID ***v13; 
  INT64 v14; 
  INT64 v15; 
  INT64 v17; 
  UINT64 v18; 
  UINT64 v19; 

  ExAcquireResourceExclusiveLite((UINT64)&unk_140C47450, 1, (INT64)VolumeIdHash);
  for( i = (__int64 *)qword_140C47440; i != &qword_140C47440; i = (__int64 *)*i )
  {
    v7 = *(__int64 *)((char *)i + 20) - *(_QWORD *)&VolumeGuid->Data1;
    if( !v7 )
      v7 = *(__int64 *)((char *)i + 28) - *(_QWORD *)VolumeGuid->Data4;
    if( !v7 )
    {
      ++*((_DWORD *)i + 4);
      *(_DWORD *)VolumeIdHash = *((_DWORD *)i + 9);
      goto LABEL_20;
    }
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1752453958i64);
  if( !PoolWithTag )
  {
    v9 = -1073741670;
    goto LABEL_21;
  }
  v10 = (VOID **)qword_140C47440;
  v11 = VolumeGuid->Data1 ^ (VolumeGuid->Data3 | (VolumeGuid->Data2 << 16)) ^ (VolumeGuid->Data4[7] | (VolumeGuid->Data4[2] << 24));
  while( v10 != &qword_140C47440 )
  {
    if( *((_DWORD *)v10 + 9) == (_DWORD)v11 )
    {
      v11 = (unsigned int)(v11 + 1);
      if( !(_DWORD)v11 )
        v10 = (VOID **)&qword_140C47440;
    }
    else if( *((_DWORD *)v10 + 9) > (unsigned int)v11 )
    {
      break;
    }
    v10 = (VOID **)*v10;
  }
  *(_OWORD *)PoolWithTag = 0i64;
  *((_OWORD *)PoolWithTag + 1) = 0i64;
  PoolWithTag[4] = 0i64;
  v12 = *VolumeGuid;
  *((_DWORD *)PoolWithTag + 9) = v11;
  *((_DWORD *)PoolWithTag + 4) = 1;
  *(_GUID *)((char *)PoolWithTag + 20) = v12;
  v13 = (VOID ***)v10[1];
  if( *v13 != v10 )
    __fastfail(3u);
  PoolWithTag[1] = v13;
  *PoolWithTag = v10;
  *v13 = PoolWithTag;
  v10[1] = PoolWithTag;
  *(_DWORD *)VolumeIdHash = v11;
  McGenEventRegister_EtwRegister(
    (_LPCGUID)MS_StorageTiering_Provider,
    v11,
    MS_StorageTiering_Provider_Context,
    MS_StorageTiering_Provider_Context);
LABEL_20:
  v9 = 0;
LABEL_21:
  ExReleaseResourceLite(&unk_140C47450);
  if( v9 >= 0 )
  {
    if( (byte_140C474B8 & 1) != 0 )
    {
      LODWORD(v17) = *(_DWORD *)VolumeIdHash;
      McTemplateK0jq_EtwWriteTransfer(v15, v14, ActivityId, (INT64)VolumeGuid, v17);
    }
    LODWORD(v19) = 0;
    LODWORD(v18) = 0;
    ZwUpdateWnfStateData(&WNF_FSRL_TIERED_VOLUME_DETECTED, 0i64, 0i64, 0i64, 0i64, v18, v19);
  }
  return v9;
}

Referenced by: