PfLogFileDataAccess

NTSTATUS __stdcall PfLogFileDataAccess(
        UINT64 FileKey,
        _ETHREAD *Thread,
        UINT64 FileOffset,
        UINT64 PageCount,
        PF_FILE_ACCESS_TYPE AccessType){
  __int64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12[4]; 
  int StreamSequenceNumber; 
  int v14; 

  if( (unsigned int)PsGetPagePriorityThread(Thread) < *(&stru_140C4DB30 + 655) )
    return 0;
  v10 = *(_QWORD *)(v5 + 544);
  v11 = *(_QWORD *)(v10 + 1088) ^ *(_QWORD *)(v10 + 1128);
  v12[2] = v7 & 0x7FFFFFFFFFFFFFFFi64 | ((__int64)(int)AccessType << 63);
  v12[1] = v6 >> 12;
  StreamSequenceNumber = PfKernelGlobals.StreamSequenceNumber;
  v14 = *(_DWORD *)(v10 + 1088);
  v12[3] = v11 & 0x1FFFFFFFFFFFFFFFi64;
  v12[0] = v8;
  return PfLogEvent(
           10,
           dword_140C5001C
         + (unsigned int)((((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
                         + ((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10),
           v12,
           0x28u);
}

Referenced by: