PfSnOpenVolumesForPrefetch
NTSTATUS __stdcall PfSnOpenVolumesForPrefetch(
PFSN_PREFETCH_HEADER *PrefetchHeader,
PFSN_ASYNC_PREFETCH_FLAGS *PrefetchAsync){
__int64 v2;
WCHAR *v4;
PFSN_ASYNC_PREFETCH_FLAGS v5;
unsigned int v6;
VOID **PoolWithTag;
unsigned int i;
_QWORD *v9;
int Event;
int v11;
bool v12;
unsigned int v13;
WCHAR *v14;
__int64 v15;
NTSTATUS IsVolumeMounted;
int v17;
VOID **v18;
__int64 v19;
int v20;
__int128 v21;
__int64 v22;
_QWORD *v23;
VOID **v24;
UINT64 v25;
__int64 v26;
__int64 v27;
unsigned int *v28;
PVOID *v29;
int v30;
PVOID *v31;
VOID **v32;
__int64 v33;
__int64 v34;
__int64 v35;
__int128 v36;
__int128 v37;
PFSN_PREFETCH_HEADER **v38;
VOID *v39;
_QWORD *v40;
__int64 v41;
PFSN_PREFETCH_HEADER **v43;
PVOID P;
PVOID *p_P;
int v46;
WCHAR *VolumePath;
PVOID v48;
VOID *Handle;
__int128 v50;
__m256i v51;
__m256i v52;
INT64 v53;
__int64 v54;
__int64 v55;
int v56;
int v57;
__int128 v58;
UINT64 VolumeMounted;
PFSN_ASYNC_PREFETCH_FLAGS *v60;
UINT64 cbDest;
UINT64 v62;
v60 = PrefetchAsync;
v2 = *(_QWORD *)PrefetchHeader;
p_P = &P;
HIDWORD(v53) = 0;
v57 = 0;
P = &P;
v48 = 0i64;
v52.m256i_i64[3] = 0x200000000i64;
v51.m256i_i64[3] = 0x200000000i64;
v50 = 0i64;
v46 = 0;
v4 = 0i64;
LODWORD(VolumeMounted) = 0;
v5 = 0;
LODWORD(v62) = 0;
VolumePath = 0i64;
memset(&v52, 0, 24);
memset(&v51, 0, 24);
Handle = 0i64;
PfSnLogOpenVolumesForPrefetch(v2, 1);
if( v2 && (v6 = *(_DWORD *)(v2 + 112), v6 < 0x4000) )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, 112 * v6, 1984979779i64);
*((_QWORD *)PrefetchHeader + 2) = PoolWithTag;
if( !PoolWithTag )
goto LABEL_56;
for( i = 0; i < *(_DWORD *)(v2 + 112); v9[11] |= 0x200000000ui64 )
{
v9 = (_QWORD *)(*((_QWORD *)PrefetchHeader + 2) + 112i64 * i);
memset(v9, 0i64, 0x70u);
v9[1] = v9;
*v9 = v9;
++i;
*((_OWORD *)v9 + 2) = 0i64;
*((_OWORD *)v9 + 3) = 0i64;
v9[7] |= 0x200000000ui64;
*((_OWORD *)v9 + 4) = 0i64;
*((_OWORD *)v9 + 5) = 0i64;
}
LODWORD(v53) = 48;
v54 = 0i64;
v56 = 512;
v55 = 0i64;
v58 = 0i64;
Event = NtCreateEvent((UINT64)&Handle, 0x1F0003ui64, (INT64)&v53, 0i64, 0);
if( Event < 0 )
goto LABEL_40;
IopGetDeviceInterfaces(&GUID_DEVINTERFACE_VOLUME, 0i64, 0i64, 0, &VolumePath, 0i64);
v4 = VolumePath;
Event = v11;
if( v11 < 0 )
goto LABEL_40;
v12 = *VolumePath == 0;
v13 = 0;
LODWORD(cbDest) = 0;
v14 = VolumePath;
while( !v12 )
{
v15 = -1i64;
do
++v15;
while( v14[v15] );
VolumePath = (WCHAR *)(2i64 * (unsigned int)(v15 + 1));
if( v13 <= (unsigned __int64)VolumePath )
LODWORD(cbDest) = 2 * v15 + 2;
IsVolumeMounted = PfSnIsVolumeMounted(v14, &VolumeMounted, &v62);
v17 = VolumeMounted;
if( IsVolumeMounted < 0 )
v17 = 0;
LODWORD(VolumeMounted) = v17;
if( v17 && !(_DWORD)v62 && (int)PfSnQueryVolumeInfo(*((_QWORD *)PrefetchHeader + 1), v14, &v52, &v48, &v46) >= 0 )
{
v18 = ExAllocatePoolWithTag(1ui64, 0x48ui64, 1984979779i64);
v19 = (__int64)v18;
if( !v18 )
goto LABEL_56;
memset(v18, 0i64, 0x48u);
v20 = v46;
v21 = *(_OWORD *)&v52.m256i_u64[2];
v22 = (__int64)v48;
*(_OWORD *)(v19 + 16) = *(_OWORD *)v52.m256i_i8;
*(_DWORD *)(v19 + 60) = v20;
*(_QWORD *)(v19 + 64) = v22;
*(_OWORD *)(v19 + 32) = v21;
*(_QWORD *)(v19 + 48) = v14;
*(_DWORD *)(v19 + 56) = v15;
memset(&v52, 0, 24);
v23 = p_P;
v52.m256i_i64[3] = 0x200000000i64;
if( *p_P != &P )
LABEL_60:
__fastfail(3u);
*(_QWORD *)(v19 + 8) = p_P;
*(_QWORD *)v19 = &P;
*v23 = v19;
p_P = (PVOID *)v19;
}
v14 = (WCHAR *)((char *)v14 + (_QWORD)VolumePath);
v13 = cbDest;
v12 = *v14 == 0;
}
cbDest = v13 + 2;
v24 = ExAllocatePoolWithTag(1ui64, cbDest, 1984979779i64);
if( v24 )
{
v25 = v2 + *(unsigned int *)(v2 + 108);
v26 = 0i64;
v62 = v25;
for( LODWORD(VolumeMounted) = 0; (unsigned int)v26 < *(_DWORD *)(v2 + 112); LODWORD(VolumeMounted) = v26 )
{
v27 = *((_QWORD *)PrefetchHeader + 2) + 112 * v26;
v28 = (unsigned int *)(v25 + 96 * v26);
*(_QWORD *)(v27 + 16) = v25 + *v28;
*(_DWORD *)(v27 + 24) = v28[1];
*(_DWORD *)(v27 + 104) = 0;
*(_QWORD *)(v27 + 96) = v25 + v28[7];
v29 = (PVOID *)P;
if( P == &P )
goto LABEL_53;
do
{
v30 = *((_DWORD *)v29 + 15);
v31 = v29;
v48 = v29[8];
if( PfMetadataRecordIsEqual((__int64)v28, &v48, v30) )
break;
v29 = (PVOID *)*v29;
}
while( v29 != &P );
if( v29 == &P )
goto LABEL_53;
RtlStringCbPrintfW((WCHAR *)v24, cbDest, (WCHAR *)L"%s\\");
v32 = v24;
v50 = 0i64;
v33 = 0x7FFFi64;
do
{
if( !*(_WORD *)v32 )
break;
v32 = (VOID **)((char *)v32 + 2);
--v33;
}
while( v33 );
v34 = (0x7FFF - v33) & ((unsigned __int128)-(__int128)(unsigned __int64)v33 >> 64);
if( v33 )
{
*((_QWORD *)&v50 + 1) = v24;
LOWORD(v50) = 2 * v34;
WORD1(v50) = 2 * v34 + 2;
}
v35 = (__int64)(v31 + 2);
if( (int)PfpOpenHandleCreate(
(__int64)&v51,
*((_QWORD *)PrefetchHeader + 1),
(__int64)&v50,
0i64,
1179785,
0x21u,
0x80u,
v35) < 0 )
{
LABEL_53:
memset(&v51, 0, 24);
v51.m256i_i64[3] = 0x200000000i64;
v43 = (PFSN_PREFETCH_HEADER **)*((_QWORD *)PrefetchHeader + 4);
if( *v43 != PrefetchHeader + 6 )
goto LABEL_60;
*(_QWORD *)v27 = PrefetchHeader + 6;
*(_QWORD *)(v27 + 8) = v43;
*v43 = (PFSN_PREFETCH_HEADER *)v27;
*((_QWORD *)PrefetchHeader + 4) = v27;
}
else
{
*(_OWORD *)(v27 + 32) = *(_OWORD *)v35;
*(_OWORD *)(v27 + 48) = *(_OWORD *)(v35 + 16);
v36 = *(_OWORD *)&v51.m256i_u64[2];
v51.m256i_i64[3] = 0x200000000i64;
*(_OWORD *)v35 = 0i64;
*(_OWORD *)(v35 + 16) = 0i64;
*(_QWORD *)(v35 + 24) |= 0x200000000ui64;
v37 = *(_OWORD *)v51.m256i_i8;
v51.m256i_i64[0] = 0i64;
*(_OWORD *)(v27 + 64) = v37;
*(_OWORD *)(v27 + 80) = v36;
v38 = (PFSN_PREFETCH_HEADER **)*((_QWORD *)PrefetchHeader + 6);
*(_OWORD *)&v51.m256i_u64[1] = 0i64;
if( *v38 != PrefetchHeader + 10 )
goto LABEL_60;
*(_QWORD *)v27 = PrefetchHeader + 10;
*(_QWORD *)(v27 + 8) = v38;
*v38 = (PFSN_PREFETCH_HEADER *)v27;
v39 = Handle;
*((_QWORD *)PrefetchHeader + 6) = v27;
*(_DWORD *)(v27 + 108) ^= (*(_DWORD *)(v27 + 108) ^ PfSnVolumeCheckSeekPenalty((_QWORD *)(v27 + 32), v39)) & 1;
if( (*(_DWORD *)(v27 + 108) & 1) != 0 )
{
v5 |= 1u;
}
else if( (v5 & 3) == 0 && !(unsigned int)PfSnVolumeCheckIsSdBus((_QWORD *)(v27 + 32), Handle) )
{
v5 |= 2u;
}
}
v25 = v62;
v26 = (unsigned int)(VolumeMounted + 1);
}
Event = 0;
*v60 = v5;
ExFreePoolWithTag(v24, 0);
}
else
{
LABEL_56:
Event = -1073741670;
}
}
else
{
Event = -1073741811;
}
LABEL_40:
if( (v52.m256i_i64[3] & 0x400000000i64) != 0 )
PfpOpenHandleClose(&v52, *((_QWORD *)PrefetchHeader + 1));
while( 1 )
{
v40 = P;
if( P == &P )
break;
if( *((PVOID **)P + 1) != &P )
goto LABEL_60;
v41 = *(_QWORD *)P;
if( *(PVOID *)(*(_QWORD *)P + 8i64) != P )
goto LABEL_60;
P = *(PVOID *)P;
*(_QWORD *)(v41 + 8) = &P;
if( (v40[5] & 0x400000000i64) != 0 )
PfpOpenHandleClose(v40 + 2, *((_QWORD *)PrefetchHeader + 1));
ExFreePoolWithTag(v40, 0);
}
if( v4 )
ExFreePoolWithTag(v4, 0);
if( Handle )
NtClose((UINT64)Handle);
PfSnLogOpenVolumesForPrefetch(v2, 0);
return Event;
}Referenced by:
PfSnAsyncPrefetchWorker