PfpRpControlRequestUpdate

NTSTATUS __stdcall PfpRpControlRequestUpdate(PFPRP_CONTEXT *RpContext, PF_ROBUSTNESS_CONTROL *Request){
  _RTL_CHASH_ENTRY *v3; 
  unsigned int v5; 
  _RTL_CHASH_ENTRY *v6; 
  _RTL_CHASH_ENTRY *v7; 
  PF_ROBUSTNESS_CONTROL v8; 
  __int64 v9; 
  VOID *Key_high; 
  unsigned __int64 Key_low; 
  _EPROCESS *v12; 
  NTSTATUS result; 
  UINT64 v14; 
  UINT64 v15; 
  UINT64 EntryCount; 
  UINT64 EntryCounta; 
  _EPROCESS *Process; 

  Process = 0i64;
  v3 = (_RTL_CHASH_ENTRY *)(Request + 6);
  v5 = 0;
  v6 = v3;
  v7 = v3;
  v8 = Request[1];
  v9 = (unsigned int)(v8 + Request[2]);
  if( (_DWORD)v9 )
  {
    do
    {
      Key_high = (VOID *)HIDWORD(v7->Key);
      Key_low = LODWORD(v7->Key);
      v6->Key = Key_low;
      ++v6;
      if( (_DWORD)Key_high && PsLookupProcessByProcessId(Key_high, &Process) >= 0 )
      {
        v12 = Process;
        if( Process->ImagePathHash == (_DWORD)Key_low )
        {
          if( v5 < Request[1] )
            _InterlockedOr((volatile signed __int32 *)&Process->1124, 0x4000u);
          else
            _InterlockedAnd((volatile signed __int32 *)&Process->1124, 0xFFFFBFFF);
          v12 = Process;
        }
        ObfDereferenceObjectWithTag(v12, 0x746C6644ui64);
      }
      ++v5;
      ++v7;
    }
    while( v5 < (unsigned int)v9 );
    v8 = Request[1];
    v3 = (_RTL_CHASH_ENTRY *)(Request + 6);
  }
  LODWORD(EntryCount) = v8;
  result = PfpRpCHashAddEntries(
             RpContext,
             (_RTL_CHASH_TABLE *)RpContext + 4,
             (_EX_PUSH_LOCK *)RpContext + 15,
             v3,
             EntryCount);
  if( result >= 0 )
  {
    v14 = (unsigned int)Request[2];
    if( !(_DWORD)v14
      || !RpContext[28]
      || (result = PfpRpCHashDeleteEntries(
                     RpContext,
                     (_RTL_CHASH_TABLE *)RpContext + 4,
                     (_EX_PUSH_LOCK *)RpContext + 15,
                     v14,
                     (_RTL_CHASH_ENTRY *)&Request[2 * Request[1] + 6]),
          result >= 0) )
    {
      LODWORD(EntryCounta) = Request[4];
      PfpRpCHashAddEntries(
        RpContext,
        (_RTL_CHASH_TABLE *)(RpContext + 14),
        (_EX_PUSH_LOCK *)RpContext + 11,
        (_RTL_CHASH_ENTRY *)((((unsigned __int64)&Request[2 * v9 + 7] + 3) & 0xFFFFFFFFFFFFFFF8ui64)
                           + 8i64 * (unsigned int)Request[3]),
        EntryCounta);
      v15 = (unsigned int)Request[3];
      if( (_DWORD)v15 && RpContext[18] )
      {
        result = PfpRpCHashDeleteEntries(
                   RpContext,
                   (_RTL_CHASH_TABLE *)(RpContext + 14),
                   (_EX_PUSH_LOCK *)RpContext + 11,
                   v15,
                   (_RTL_CHASH_ENTRY *)(((unsigned __int64)&Request[2 * v9 + 7] + 3) & 0xFFFFFFFFFFFFFFF8ui64));
        if( result < 0 )
          return result;
        *((_QWORD *)RpContext + 10) = 0i64;
      }
      return 0;
    }
  }
  return result;
}

Referenced by: