PfpVolumeOpenAndVerify
NTSTATUS __fastcall PfpVolumeOpenAndVerify(_PFP_PREFETCH_CONTEXT_SHARED *PrefetchContext, _OWORD *a2, INT64 a3){
__int64 v6;
NTSTATUS v7;
NTSTATUS VolumeInformationFile;
VOID **PoolWithTag;
__int128 v10;
__int128 v11;
__int128 v12;
__int128 v13;
_LARGE_INTEGER *AllocationSize;
_LARGE_INTEGER *AllocationSizea;
UINT64 FileAttributes;
UINT64 ShareAccess;
UINT64 CreateDisposition;
UINT64 CreateOptions;
UINT64 EaLength;
VOID *FileHandle;
_DEVICE_POWER_STATE State;
__int64 v24;
PVOID P;
__int16 v26[2];
int v27;
VOID *Src;
__m256i v29;
_FILE_FS_DEVICE_INFORMATION FsInformation;
__m256i v31;
_IO_STATUS_BLOCK IoStatusBlock;
_OBJECT_ATTRIBUTES ObjectAttributes;
UINT64 v34[2];
__int64 v35;
*(_QWORD *)&ObjectAttributes.Length = 48i64;
LODWORD(EaLength) = 0;
v35 = 0i64;
Src = *(VOID **)(a3 + 32);
LODWORD(CreateOptions) = 32;
v26[0] = 2 * *(_WORD *)(a3 + 24);
LODWORD(CreateDisposition) = 1;
v26[1] = v26[0] + 2;
LODWORD(ShareAccess) = 7;
v6 = 0x200000000i64;
LODWORD(FileAttributes) = 0;
ObjectAttributes.ObjectName = (_UNICODE_STRING *)v26;
FsInformation = 0i64;
*(_OWORD *)v34 = 0i64;
v27 = 0;
*(_QWORD *)&ObjectAttributes.Attributes = 576i64;
IoStatusBlock = 0i64;
v24 = 0i64;
State = PowerDeviceUnspecified;
memset(&v29, 0, 24);
v29.m256i_i64[3] = 0x200000000i64;
memset(&v31, 0, 24);
v31.m256i_i64[3] = 0x200000000i64;
P = 0i64;
FileHandle = 0i64;
ObjectAttributes.RootDirectory = 0i64;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v7 = NtCreateFile(
&FileHandle,
0x100080ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
FileAttributes,
ShareAccess,
CreateDisposition,
CreateOptions,
0i64,
EaLength);
VolumeInformationFile = v7;
if( v7 >= 0 )
{
if( v7 == 259 )
KeBugCheckEx(0x191u, (PVOID)0x1336, 0i64, 0i64, 0i64);
LODWORD(AllocationSize) = 4;
VolumeInformationFile = NtQueryVolumeInformationFile(
(UINT64)FileHandle,
(UINT64)&IoStatusBlock,
(UINT64)&FsInformation,
8ui64,
(UINT64)AllocationSize);
if( (VolumeInformationFile & 0xC0000000) != -1073741824 )
{
if( VolumeInformationFile == 259 )
KeBugCheckEx(0x191u, (PVOID)0x1346, 0i64, 0i64, 0i64);
if( PfVolumeSupportedForPrefetch(&FsInformation) )
{
VolumeInformationFile = -1073741637;
goto LABEL_16;
}
if( (*(_DWORD *)(a3 + 12) & 1) == 0 )
goto LABEL_7;
VolumeInformationFile = NtGetDevicePowerState(FileHandle, &State);
if( VolumeInformationFile < 0 )
goto LABEL_16;
if( (unsigned int)State > PowerDeviceD0 )
{
VolumeInformationFile = -2147483633;
}
else
{
LABEL_7:
NtClose((UINT64)FileHandle);
FileHandle = 0i64;
VolumeInformationFile = PfpOpenHandleCreate(
(__int64)&v29,
(__int64)PrefetchContext,
(__int64)v26,
0i64,
1048960,
0x20u,
0,
0i64);
if( VolumeInformationFile < 0 )
goto LABEL_16;
if( !*(_QWORD *)a3 && !*(_DWORD *)(a3 + 8) )
goto LABEL_13;
LODWORD(AllocationSizea) = 1;
VolumeInformationFile = NtQueryVolumeInformationFile(
v29.m256i_u64[0],
(UINT64)&IoStatusBlock,
(UINT64)v34,
0x18ui64,
(UINT64)AllocationSizea);
if( (VolumeInformationFile & 0xC0000000) == -1073741824 )
goto LABEL_16;
if( VolumeInformationFile == 259 )
KeBugCheckEx(0x191u, (PVOID)0x138F, 0i64, 0i64, 0i64);
if( v34[0] != *(_QWORD *)a3 || LODWORD(v34[1]) != *(_DWORD *)(a3 + 8) )
{
VolumeInformationFile = -1073741735;
}
else
{
LABEL_13:
LOWORD(v24) = v26[0] + 2;
WORD1(v24) = v26[0] + 4;
PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned __int16)(v26[0] + 4), 1146250832i64);
P = PoolWithTag;
if( PoolWithTag )
{
memmove(PoolWithTag, Src, (unsigned __int16)v26[0]);
*((_WORD *)P + ((unsigned __int64)(unsigned __int16)v26[0] >> 1)) = 92;
*((_WORD *)P + ((unsigned __int64)(unsigned __int16)v24 >> 1)) = 0;
VolumeInformationFile = PfpOpenHandleCreate(
(__int64)&v31,
(__int64)PrefetchContext,
(__int64)&v24,
0i64,
1179785,
0x21u,
0x80u,
(__int64)&v29);
if( VolumeInformationFile < 0 )
{
v6 = v31.m256i_i64[3];
}
else
{
v10 = *(_OWORD *)v29.m256i_i8;
v29.m256i_i64[0] = 0i64;
VolumeInformationFile = 0;
v11 = *(_OWORD *)&v29.m256i_u64[2];
v29.m256i_i64[3] = 0x200000000i64;
*a2 = v10;
*(_OWORD *)&v29.m256i_u64[1] = 0i64;
v12 = *(_OWORD *)v31.m256i_i8;
v31.m256i_i64[0] = 0i64;
a2[1] = v11;
v13 = *(_OWORD *)&v31.m256i_u64[2];
v31.m256i_i64[3] = 0x200000000i64;
a2[2] = v12;
*(_OWORD *)&v31.m256i_u64[1] = 0i64;
a2[3] = v13;
}
}
else
{
VolumeInformationFile = -1073741670;
}
}
}
}
}
LABEL_16:
if( FileHandle )
NtClose((UINT64)FileHandle);
if( (v6 & 0x400000000i64) != 0 )
PfpOpenHandleClose(&v31, (__int64)PrefetchContext);
if( (v29.m256i_i64[3] & 0x400000000i64) != 0 )
PfpOpenHandleClose(&v29, (__int64)PrefetchContext);
if( P )
ExFreePoolWithTag(P, 0);
return VolumeInformationFile;
}Referenced by:
PfpPrefetchRequestPerform