PfpCopyEvent

NTSTATUS __fastcall PfpCopyEvent(VOID *Src){
  unsigned __int64 v1; 
  int v2; 
  __int64 v4; 
  unsigned __int8 v5; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  unsigned __int64 *v10; 
  unsigned __int64 v11; 
  __int64 v13; 
  __int64 v14; 
  _EPROCESS *v15; 
  unsigned __int64 v16; 
  __int128 v17; 
  __int64 v18; 
  _EPROCESS *Process; 

  v1 = *(_QWORD *)Src;
  v2 = *(_QWORD *)Src;
  Process = 0i64;
  LODWORD(v18) = 0;
  if( (v2 & 0x1F000) != 40960i64 )
  {
    v13 = (v1 >> 2) & 0x3FF;
    v14 = PfTAcquireLogEntry((_PFP_BUFFER_MANAGER *)&stru_140C4DB30 + 319, &v18, (v1 >> 2) & 0x3FF);
    if( !v14 )
      return -1073741670;
    memmove((VOID *)(((v14 + 31) & 0xFFFFFFFFFFFFFFF8ui64) + 16i64 * (unsigned int)v18), Src, 16 * v13);
    return 0;
  }
  v4 = *((_QWORD *)Src + 4);
  v5 = v4;
  v17 = 0i64;
  if( (v4 & 0x7FFFFFFFFFFFFFFFui64) >= 0xFF )
    v5 = -1;
  v6 = 2i64;
  if( v4 >= 0 )
    v6 = 4098i64;
  v7 = *((_DWORD *)Src + 12) & 0xFF000000;
  DWORD2(v17) = v5 | (*((_DWORD *)Src + 12) << 8);
  v8 = *((_QWORD *)Src + 5);
  v9 = *((_QWORD *)Src + 3) << 12;
  *(_QWORD *)&v17 = v6 & 0xFFFFFFFF00FFFFFFui64 | v7;
  v18 = v9 | 1;
  v10 = PfpLogPageAccess(v8, &v18, &v17, (__int64)Src + 24, 1);
  if( !v10 )
    return -1073741432;
  v11 = ((*(&stru_140C4DB30 + 965) + 47i64) & 0xFFFFFFFFFFFFFFF8ui64)
      + 40i64 * (*((unsigned __int16 *)v10 + 5) - (unsigned int)*(unsigned __int16 *)(*(&stru_140C4DB30 + 965) + 36i64));
  if( (*(_BYTE *)(v11 + 8) & 4) == 0 || PsLookupProcessByProcessId((VOID *)*((unsigned int *)Src + 13), &Process) < 0 )
    return 0;
  v15 = Process;
  if( (((__int64)Process->UniqueProcessId ^ Process->CreateTime.QuadPart) & 0x1FFFFFFFFFFFFFFFi64) == *((_QWORD *)Src + 5) )
  {
    if( (unsigned int)PfpIsProcessInfoPresent(Process) )
    {
      v16 = *(_QWORD *)(v11 + 8) & 0xFFFFFFFFFFFFFFF8ui64 | 1;
      *(_QWORD *)(v11 + 8) = v16;
      *(_QWORD *)(v11 + 8) = v16 & 7 | (8 * ((__int64)v15->UniqueProcessId ^ v15->CreateTime.QuadPart));
      *(_DWORD *)(v11 + 28) = v15->ImagePathHash;
      *(_DWORD *)(v11 + 24) = v15->UniqueProcessId;
      *(_QWORD *)(v11 + 16) = v15;
    }
  }
  ObfDereferenceObjectWithTag(v15, 0x746C6644ui64);
  return 0;
}

Referenced by: