PfSnGetFileInformation

NTSTATUS __stdcall PfSnGetFileInformation(PFSN_TRACE_HEADER *Trace, _FILE_OBJECT *FileObject){
  NTSTATUS v2; 
  void *FsContext; 
  UINT8 v4; 
  int v7; 
  PFSN_TRACE_HEADER *v8; 
  PFSN_TRACE_HEADER *v9; 
  unsigned __int64 v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  int v14; 
  unsigned __int64 v15; 
  VOID **PoolWithTag; 
  UINT64 v17; 
  unsigned __int8 v18; 
  __int64 v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  int v22; 
  unsigned __int64 v23; 
  __int64 v24; 
  UINT64 v25; 
  BOOL v26; 
  int v27; 
  UINT64 v28; 
  unsigned __int8 v29; 

  v2 = 0;
  FsContext = FileObject->FsContext;
  v4 = 0;
  v7 = 0;
  if( (FileObject->DeviceObject->Characteristics & 0x10) != 0 )
    return -1073741637;
  v8 = Trace + 122;
  v9 = Trace + 130;
  if( v8 >= v9 )
  {
LABEL_5:
    v10 = (unsigned __int64)(Trace + 130);
    v29 = ExAcquireSpinLockShared((INT64 *)Trace + 72);
    v11 = *((_QWORD *)Trace + 66);
    v12 = *((_QWORD *)Trace + 65);
    if( (v11 & 1) != 0 )
    {
      if( v12 )
        v12 ^= v10;
      else
        v12 = 0i64;
    }
    v14 = v11 & 1;
    while( v12 )
    {
      if( *(_QWORD *)(v12 + 24) > (unsigned __int64)FsContext )
      {
        v15 = *(_QWORD *)v12;
        if( v14 && v15 )
        {
          v12 ^= v15;
          continue;
        }
      }
      else
      {
        if( *(_QWORD *)(v12 + 24) >= (unsigned __int64)FsContext )
          break;
        v15 = *(_QWORD *)(v12 + 8);
        if( v14 && v15 )
        {
          v12 ^= v15;
          continue;
        }
      }
      v12 = v15;
    }
    ExReleaseSpinLockSharedFromDpcLevel(Trace + 144);
    __writecr8(v29);
    if( v12 )
    {
      *(_QWORD *)&Trace[2 * (++*((_BYTE *)Trace + 580) & 3) + 122] = FsContext;
      return 0;
    }
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x30ui64, 1850762051i64);
    v17 = (UINT64)PoolWithTag;
    if( !PoolWithTag )
    {
      if( (Trace[121] & 2) == 0 )
        _InterlockedOr16((volatile signed __int16 *)Trace + 242, 2u);
      return -1073741670;
    }
    *(_OWORD *)PoolWithTag = 0i64;
    *((_OWORD *)PoolWithTag + 1) = 0i64;
    *((_OWORD *)PoolWithTag + 2) = 0i64;
    ObfReferenceObjectWithTag(FileObject, 0x746C6644ui64);
    *(_QWORD *)(v17 + 40) = FileObject;
    *(_QWORD *)(v17 + 24) = FsContext;
    v18 = ExAcquireSpinLockExclusive((INT64 *)Trace + 72);
    v19 = *((_QWORD *)Trace + 66);
    v20 = *(_QWORD *)v10;
    v21 = v18;
    if( (v19 & 1) != 0 )
    {
      if( v20 )
        v20 ^= v10;
      else
        v20 = 0i64;
    }
    v22 = v19 & 1;
    if( !v20 )
    {
LABEL_34:
      if( !*((_QWORD *)Trace + 71) )
      {
        v4 = ExAcquireRundownProtection((_EX_RUNDOWN_REF *)Trace + 45);
        if( !v4 )
        {
          v2 = -1073741431;
LABEL_30:
          ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)Trace + 72);
          __writecr8(v21);
          HalPutDmaAdapter(*(PADAPTER_OBJECT *)(v17 + 40));
          ExFreePoolWithTag((PVOID)v17, 0);
          return v2;
        }
        *((_QWORD *)Trace + 71) = Trace;
        *((_QWORD *)Trace + 70) = PfSnNameQueryWorker;
        v7 = 1;
        *((_QWORD *)Trace + 68) = 0i64;
      }
      *(_QWORD *)(v17 + 32) = *((_QWORD *)Trace + 67);
      *((_QWORD *)Trace + 67) = v17 + 32;
      v24 = *((_QWORD *)Trace + 66);
      v25 = *(_QWORD *)v10;
      if( (v24 & 1) != 0 )
      {
        if( v25 )
          v25 ^= v10;
        else
          v25 = 0i64;
      }
      v26 = 0;
      v27 = v24 & 1;
      if( v25 )
      {
        while( 1 )
        {
          if( *(_QWORD *)(v25 + 24) > (unsigned __int64)FsContext )
          {
            v28 = *(_QWORD *)v25;
            if( v27 )
            {
              if( !v28 )
                break;
              v28 ^= v25;
            }
            if( !v28 )
              break;
          }
          else
          {
            v28 = *(_QWORD *)(v25 + 8);
            if( v27 )
            {
              if( !v28 )
                goto LABEL_57;
              v28 ^= v25;
            }
            if( !v28 )
            {
LABEL_57:
              v26 = 1;
              break;
            }
          }
          v25 = v28;
        }
      }
      RtlRbInsertNodeEx((UINT64 *)Trace + 65, v25, v26, v17);
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)Trace + 72);
      __writecr8(v21);
      if( v7 )
      {
        v4 = 0;
        ExQueueWorkItem((PWORK_QUEUE_ITEM)Trace + 17, DelayedWorkQueue);
      }
      *(_QWORD *)&Trace[2 * (++*((_BYTE *)Trace + 580) & 3) + 122] = FsContext;
      if( v4 )
        ExReleaseRundownProtection((_EX_RUNDOWN_REF *)Trace + 45);
      return 0;
    }
    while( 1 )
    {
      if( *(_QWORD *)(v20 + 24) > (unsigned __int64)FsContext )
      {
        v23 = *(_QWORD *)v20;
        if( v22 && v23 )
        {
          v20 ^= v23;
          goto LABEL_33;
        }
      }
      else
      {
        if( *(_QWORD *)(v20 + 24) >= (unsigned __int64)FsContext )
          goto LABEL_30;
        v23 = *(_QWORD *)(v20 + 8);
        if( v22 && v23 )
        {
          v20 ^= v23;
          goto LABEL_33;
        }
      }
      v20 = v23;
LABEL_33:
      if( !v20 )
        goto LABEL_34;
    }
  }
  while( *(void **)v8 != FsContext )
  {
    v8 += 2;
    if( v8 >= v9 )
      goto LABEL_5;
  }
  return 0;
}

Referenced by: