PfFileInfoNotify
VOID __fastcall PfFileInfoNotify(INT64 FileInfo){
_DWORD *v1;
bool v2;
int v3;
int v4;
__int64 v5;
__int64 v6;
unsigned __int64 v7;
__int64 v8;
__int64 v9;
__int64 v10;
unsigned __int64 v11;
__int64 v12;
__int64 v13;
unsigned int v14;
__int64 v15;
PSLIST_ENTRY v16;
unsigned __int64 *v17;
__int64 v18;
int v19;
INT64 v20;
PSLIST_ENTRY j;
int v22;
unsigned __int64 v23;
__int128 v24;
__int128 v25;
_SLIST_ENTRY *Next;
_ETHREAD *v27;
unsigned __int64 v28;
__int64 v29;
UINT64 v30;
_PFSN_TRACE_HEADER *v31;
_PFSN_TRACE_HEADER *v32;
int v33;
PFFI_FILEINFO_STREAM_INFO *v34;
__int64 v35;
unsigned int v36;
const VOID *v37;
int v38;
size_t v39;
unsigned int v40;
int v41;
INT64 v42;
int v43;
wchar_t *v44;
INT64 v45;
int v46;
unsigned __int64 v47;
__int64 *v48;
__int64 *v49;
unsigned __int64 v50;
int v51;
PFFI_FILEINFO_STREAM_INFO *v52;
int v53;
int *v54;
int v55;
int v56;
size_t v57;
int v58;
INT64 v59;
__int16 v60;
int v61;
_ETHREAD *v62;
unsigned int v63;
_ETHREAD *v64;
_ETHREAD *v65;
unsigned int v66;
int v67;
__int64 v68;
_KLOCK_ENTRY *v69;
_ETHREAD *v70;
int v71;
__int64 v72;
_KLOCK_ENTRY *v73;
__int64 v74;
__int64 v75;
int v76;
_ETHREAD *CurrentThread;
unsigned int v78;
_ETHREAD *v79;
__int64 *i;
_ETHREAD *v81;
unsigned int SessionId;
int v83;
__int64 v84;
_KLOCK_ENTRY *v85;
__int64 v86;
_ETHREAD *v87;
int v88;
__int64 v89;
_KLOCK_ENTRY *v90;
__int64 v91;
_SLIST_ENTRY *v92;
VOID **Flags;
UINT64 v94;
UINT64 v95;
UINT64 v96;
UINT64 v97;
_BYTE BufferOut[8];
INT64 a3;
int v100;
int v101;
__int64 v102;
unsigned __int64 v103;
__int64 v104[2];
int StreamSequenceNumber;
int v106;
__int128 v107;
__int128 v108;
unsigned __int64 v109;
unsigned __int8 v111;
unsigned __int8 v112;
unsigned __int8 AbAllocationRegionCount;
unsigned __int8 v114;
_FILE_OBJECT *FileObject;
UINT64 v116;
int v117;
v1 = (_DWORD *)FileInfo;
v2 = *(_DWORD *)FileInfo == 15;
v101 = 0;
v106 = 0;
*(_QWORD *)BufferOut = 0i64;
a3 = 0i64;
if( !v2 )
goto LABEL_61;
v3 = *(_DWORD *)(FileInfo + 8);
if( (v3 & 8) != 0 )
{
v33 = *(_DWORD *)(FileInfo + 4);
if( v33 == 7 )
{
v1[4] = _InterlockedIncrement(&PfKernelGlobals.StreamSequenceNumber);
return;
}
v61 = v33 - 10;
if( v61 )
{
v76 = v61 - 1;
if( v76 )
{
if( v76 != 1 || (dword_140C50290 & 2) != 0 )
goto LABEL_61;
return;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&qword_140C50148, 0i64);
v78 = -1;
if( qword_140C50138 )
{
v79 = (_ETHREAD *)KeGetCurrentThread();
--v79->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&qword_140C50150, 0i64);
dword_140C50168 |= 1u;
for( i = (__int64 *)qword_140C50158; i != &qword_140C50158; i = (__int64 *)*i )
{
*((_DWORD *)i + 17) |= 4u;
KeSetEvent((PRKEVENT)(i + 11), 0, 0);
}
if( (_InterlockedExchangeAdd64(&qword_140C50150._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&qword_140C50150);
LODWORD(v116) = 0;
v81 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&qword_140C50150) == 1 )
SessionId = MmGetSessionIdEx(v81->Tcb.ApcState.Process);
else
SessionId = -1;
--v81->Tcb.SpecialApcDisable;
++v81->Tcb.AbAllocationRegionCount;
v83 = ((char)v81->Tcb.AbEntrySummary | (char)v81->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
AbAllocationRegionCount = v81->Tcb.AbAllocationRegionCount;
v2 = !_BitScanReverse((unsigned int *)&v84, v83);
if( v2 )
goto LABEL_147;
while( 1 )
{
v85 = &v81->Tcb.LockEntries[v84];
v83 &= ~(1 << v84);
if( (v85->AcquiredByte & 1) != 0
&& (v85->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v85->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50150 & 0x7FFFFFFFFFFFFFFCi64)
&& v85->LockState.SessionId == SessionId )
{
v85->AcquiredByte &= ~1u;
if( v85->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v84, v83);
if( v2 )
goto LABEL_147;
}
if( !v85 )
{
LABEL_147:
if( (*(&v81->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v81, &qword_140C50150, (PVOID)SessionId, 0i64);
}
else
{
v85->CrossThreadReleasableAndBusyByte |= 2u;
if( v85->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v85);
LODWORD(v116) = v85->BoostBitmap.AllFields & 0x1FFFF;
v85->BoostBitmap.AllFields &= 0xFFFE0000;
v85->ThreadLocalFlags &= ~1u;
v85->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v86 = v85 - v81->Tcb.LockEntries;
if( AbAllocationRegionCount == 1 )
v81->Tcb.AbEntrySummary |= 1 << v86;
else
_InterlockedOr8((volatile signed __int8 *)&v81->Tcb.AbOrphanedEntrySummary, 1 << v86);
}
--v81->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v81->Tcb, &qword_140C50150, &v116);
v2 = v81->Tcb.SpecialApcDisable++ == -1;
if( v2 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v81->Tcb.ApcState.ApcListHead[0].Flink != &v81->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
ExWaitForRundownProtectionRelease(&RunRef);
ExRundownCompleted((INT64 *)&RunRef);
qword_140C50138 = 0i64;
v22 = 0;
}
else
{
v22 = -1073741275;
}
if( (_InterlockedExchangeAdd64(&qword_140C50148._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&qword_140C50148);
LODWORD(v95) = 0;
v87 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&qword_140C50148) == 1 )
v78 = MmGetSessionIdEx(v87->Tcb.ApcState.Process);
--v87->Tcb.SpecialApcDisable;
++v87->Tcb.AbAllocationRegionCount;
v88 = ((char)v87->Tcb.AbEntrySummary | (char)v87->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v114 = v87->Tcb.AbAllocationRegionCount;
v2 = !_BitScanReverse((unsigned int *)&v89, v88);
v117 = v89;
if( v2 )
goto LABEL_171;
while( 1 )
{
v90 = &v87->Tcb.LockEntries[v89];
v88 &= ~(1 << v89);
if( (v90->AcquiredByte & 1) != 0
&& (v90->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v90->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50148 & 0x7FFFFFFFFFFFFFFCi64)
&& v90->LockState.SessionId == v78 )
{
v90->AcquiredByte &= ~1u;
if( v90->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v89, v88);
v117 = v89;
if( v2 )
goto LABEL_171;
}
if( !v90 )
{
LABEL_171:
if( (*(&v87->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v87, &qword_140C50148, (PVOID)v78, 0i64);
}
else
{
v90->CrossThreadReleasableAndBusyByte |= 2u;
if( v90->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v90);
LODWORD(v95) = v90->BoostBitmap.AllFields & 0x1FFFF;
v90->BoostBitmap.AllFields &= 0xFFFE0000;
v90->ThreadLocalFlags &= ~1u;
v90->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v91 = v90 - v87->Tcb.LockEntries;
if( v114 == 1 )
v87->Tcb.AbEntrySummary |= 1 << v91;
else
_InterlockedOr8((volatile signed __int8 *)&v87->Tcb.AbOrphanedEntrySummary, 1 << v91);
}
--v87->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v87->Tcb, &qword_140C50148, &v95);
v2 = v87->Tcb.SpecialApcDisable++ == -1;
if( v2 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v87->Tcb.ApcState.ApcListHead[0].Flink != &v87->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
else
{
v62 = (_ETHREAD *)KeGetCurrentThread();
--v62->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&qword_140C50148, 0i64);
v63 = -1;
if( qword_140C50138 )
{
v22 = -1073741791;
}
else
{
v64 = (_ETHREAD *)KeGetCurrentThread();
--v64->Tcb.KernelApcDisable;
ExAcquirePushLockExclusiveEx(&qword_140C50150, 0i64);
dword_140C50168 &= ~1u;
if( (_InterlockedExchangeAdd64(&qword_140C50150._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&qword_140C50150);
LODWORD(v96) = 0;
v65 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&qword_140C50150) == 1 )
v66 = MmGetSessionIdEx(v65->Tcb.ApcState.Process);
else
v66 = -1;
--v65->Tcb.SpecialApcDisable;
++v65->Tcb.AbAllocationRegionCount;
v67 = ((char)v65->Tcb.AbEntrySummary | (char)v65->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v111 = v65->Tcb.AbAllocationRegionCount;
v2 = !_BitScanReverse((unsigned int *)&v68, v67);
HIDWORD(v95) = v68;
if( v2 )
goto LABEL_84;
while( 1 )
{
v69 = &v65->Tcb.LockEntries[v68];
v67 &= ~(1 << v68);
if( (v69->AcquiredByte & 1) != 0
&& (v69->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v69->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50150 & 0x7FFFFFFFFFFFFFFCi64)
&& v69->LockState.SessionId == v66 )
{
v69->AcquiredByte &= ~1u;
if( v69->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v68, v67);
HIDWORD(v95) = v68;
if( v2 )
goto LABEL_84;
}
if( !v69 )
{
LABEL_84:
if( (*(&v65->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v65, &qword_140C50150, (PVOID)v66, 0i64);
}
else
{
v69->CrossThreadReleasableAndBusyByte |= 2u;
if( v69->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v69);
LODWORD(v96) = v69->BoostBitmap.AllFields & 0x1FFFF;
v69->BoostBitmap.AllFields &= 0xFFFE0000;
v69->ThreadLocalFlags &= ~1u;
v69->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v74 = v69 - v65->Tcb.LockEntries;
if( v111 == 1 )
v65->Tcb.AbEntrySummary |= 1 << v74;
else
_InterlockedOr8((volatile signed __int8 *)&v65->Tcb.AbOrphanedEntrySummary, 1 << v74);
}
--v65->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v65->Tcb, &qword_140C50150, &v96);
v2 = v65->Tcb.SpecialApcDisable++ == -1;
if( v2 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v65->Tcb.ApcState.ApcListHead[0].Flink != &v65->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
(*(void(__fastcall **)(NTSTATUS(__stdcall *)(_PFP_PREFETCH_CONTEXT_SHARED *, _PFFI_CONFLICT_INFO *, _PFFI_END_CONFLICT_CONTEXT *)))(*((_QWORD *)v1 + 2) + 32i64))(PfpPrefetchSharedConflictNotifyStart);
qword_140C50138 = *((_QWORD *)v1 + 2);
v22 = 0;
_InterlockedExchange64((volatile __int64 *)&RunRef, 0i64);
}
if( (_InterlockedExchangeAdd64(&qword_140C50148._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&qword_140C50148);
LODWORD(v97) = 0;
v70 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)&qword_140C50148) == 1 )
v63 = MmGetSessionIdEx(v70->Tcb.ApcState.Process);
--v70->Tcb.SpecialApcDisable;
++v70->Tcb.AbAllocationRegionCount;
v71 = ((char)v70->Tcb.AbEntrySummary | (char)v70->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v112 = v70->Tcb.AbAllocationRegionCount;
v2 = !_BitScanReverse((unsigned int *)&v72, v71);
HIDWORD(v96) = v72;
if( v2 )
goto LABEL_96;
while( 1 )
{
v73 = &v70->Tcb.LockEntries[v72];
v71 &= ~(1 << v72);
if( (v73->AcquiredByte & 1) != 0
&& (v73->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v73->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&qword_140C50148 & 0x7FFFFFFFFFFFFFFCi64)
&& v73->LockState.SessionId == v63 )
{
v73->AcquiredByte &= ~1u;
if( v73->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v2 = !_BitScanReverse((unsigned int *)&v72, v71);
HIDWORD(v96) = v72;
if( v2 )
goto LABEL_96;
}
if( !v73 )
{
LABEL_96:
if( (*(&v70->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v70, &qword_140C50148, (PVOID)v63, 0i64);
}
else
{
v73->CrossThreadReleasableAndBusyByte |= 2u;
if( v73->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v73);
LODWORD(v97) = v73->BoostBitmap.AllFields & 0x1FFFF;
v73->BoostBitmap.AllFields &= 0xFFFE0000;
v73->ThreadLocalFlags &= ~1u;
v73->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v75 = v73 - v70->Tcb.LockEntries;
if( v112 == 1 )
v70->Tcb.AbEntrySummary |= 1 << v75;
else
_InterlockedOr8((volatile signed __int8 *)&v70->Tcb.AbOrphanedEntrySummary, 1 << v75);
}
--v70->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v70->Tcb, &qword_140C50148, &v97);
v2 = v70->Tcb.SpecialApcDisable++ == -1;
if( v2 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v70->Tcb.ApcState.ApcListHead[0].Flink != &v70->Tcb.152 )
KiCheckForKernelApcDelivery();
KeLeaveCriticalRegion();
}
LABEL_20:
if( v22 >= 0 )
return;
goto LABEL_61;
}
if( (v3 & 4) != 0 )
{
v46 = *(_DWORD *)(FileInfo + 4);
if( v46 == 2 )
{
PfSnLogStreamCreate(*(PFFI_FILEINFO_STREAM_INFO **)(FileInfo + 16));
}
else if( v46 )
{
if( v46 == 3 )
PfSnNameRemoveAll(*(_QWORD *)(FileInfo + 16));
}
else
{
PfSnLogVolumeCreate(*(_PFFI_FILEINFO_VOLUME_INFO **)(FileInfo + 16));
}
}
if( (v1[2] & 1) != 0 )
{
if( *(&stru_140C4DB30 + 2044) >= *(&stru_140C4DB30 + 2045) )
{
v53 = v1[1];
v4 = v53;
if( v53 != 4 && v53 != 2 && v53 != 3 )
goto LABEL_61;
}
else
{
v4 = v1[1];
}
if( v4 != 4 )
{
switch( v4 )
{
case 0:
v57 = 2 * *(unsigned __int16 *)(*((_QWORD *)v1 + 2) + 30i64);
v40 = (v57 + 65) & 0xFFFFFFF8;
PfFbLogEntryReserve((INT64)&stru_140C4DB30 + 7856, BufferOut, (INT64)&a3, v40, Flags, v94);
v22 = v58;
if( v58 < 0 )
goto LABEL_179;
v59 = a3;
*(_DWORD *)a3 = (8 * v40) | *(_DWORD *)a3 & 0x80000002 | 2;
*(_DWORD *)(v59 + 4) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 52i64);
*(_DWORD *)(v59 + 8) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 56i64);
*(_QWORD *)(v59 + 24) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 8i64);
*(_DWORD *)(v59 + 36) ^= (*(_DWORD *)(v59 + 36) ^ *(_DWORD *)(*((_QWORD *)v1 + 2) + 48i64)) & 0xF;
*(_DWORD *)(v59 + 36) ^= ((unsigned __int8)*(_DWORD *)(v59 + 36) ^ (unsigned __int8)*(_DWORD *)(*((_QWORD *)v1 + 2) + 48i64)) & 0xF0;
*(_QWORD *)(v59 + 16) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 16i64);
*(_DWORD *)(v59 + 32) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 24i64);
v60 = 2 * *(_WORD *)(*((_QWORD *)v1 + 2) + 30i64);
*(_WORD *)(v59 + 40) = v60;
*(_WORD *)(v59 + 42) = v60;
memmove((VOID *)(v59 + 56), *(const VOID **)(*((_QWORD *)v1 + 2) + 40i64), v57);
v44 = (wchar_t *)(v59 + 56);
*(_WORD *)(v59 + 2i64 * *(unsigned __int16 *)(*((_QWORD *)v1 + 2) + 30i64) + 56) = 0;
goto LABEL_33;
case 1:
PfLogDeleteHelper(
PfNLInfoTypeVolume,
*(_QWORD *)(*((_QWORD *)v1 + 2) + 8i64),
*(unsigned int *)(*((_QWORD *)v1 + 2) + 56i64),
0i64);
return;
case 2:
v34 = (PFFI_FILEINFO_STREAM_INFO *)*((_QWORD *)v1 + 2);
if( HIWORD(v34[8]) <= (unsigned __int16)v34[8] )
return;
PfpRpFileKeyUpdate((PFPRP_CONTEXT *)&RpContext, v34, 1ui64);
if( *(&stru_140C4DB30 + 2044) >= *(&stru_140C4DB30 + 2045) )
goto LABEL_61;
v35 = *((_QWORD *)v1 + 2);
v36 = *(_DWORD *)(v35 + 32);
v37 = (const VOID *)(*(_QWORD *)(v35 + 24) + 2i64 * (unsigned __int16)v36);
v38 = HIWORD(v36) - (unsigned __int16)v36;
v39 = 2 * v38;
v40 = (2 * v38 + 53) & 0xFFFFFFF8;
PfFbLogEntryReserve((INT64)&stru_140C4DB30 + 7856, BufferOut, (INT64)&a3, v40, Flags, v94);
v22 = v41;
if( v41 >= 0 )
{
v42 = a3;
*(_DWORD *)a3 = *(_DWORD *)a3 & 0x80000000 | (8 * ((v39 + 53) & 0xFFFFFF8));
*(_DWORD *)(v42 + 4) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 40i64);
*(_DWORD *)(v42 + 8) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 44i64);
*(_QWORD *)(v42 + 24) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 8i64);
*(_DWORD *)(v42 + 32) = *(_DWORD *)(*((_QWORD *)v1 + 2) + 48i64);
*(_QWORD *)(v42 + 16) = *(_QWORD *)(*((_QWORD *)v1 + 2) + 16i64);
*(_DWORD *)(v42 + 40) ^= (*(_DWORD *)(v42 + 40) ^ *(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64)) & 1;
v43 = *(_DWORD *)(v42 + 40) ^ ((unsigned __int8)*(_DWORD *)(v42 + 40) ^ (unsigned __int8)(*(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64) >> 3)) & 2;
*(_DWORD *)(v42 + 40) = v43;
*(_DWORD *)(v42 + 40) = v43 ^ ((unsigned __int8)v43 ^ (unsigned __int8)(2
* *(_DWORD *)(*((_QWORD *)v1 + 2)
+ 36i64))) & 4;
*(_WORD *)(v42 + 42) = v38;
memmove((VOID *)(v42 + 44), v37, v39);
v44 = (wchar_t *)(v42 + 44);
*(_WORD *)(v42 + 2i64 * *(unsigned __int16 *)(v42 + 42) + 44) = 0;
LABEL_33:
wcsupr(v44);
PfFbLogEntryComplete(*(PSLIST_ENTRY *)BufferOut, v45, v40);
return;
}
LABEL_179:
v92 = *(_SLIST_ENTRY **)BufferOut;
if( !*(_QWORD *)BufferOut )
goto LABEL_20;
break;
case 3:
v52 = (PFFI_FILEINFO_STREAM_INFO *)*((_QWORD *)v1 + 2);
if( HIWORD(v52[8]) <= (unsigned __int16)v52[8] )
return;
PfpRpFileKeyUpdate((PFPRP_CONTEXT *)&RpContext, v52, 0i64);
if( *(&stru_140C4DB30 + 2044) >= *(&stru_140C4DB30 + 2045) )
goto LABEL_61;
PfLogDeleteHelper(
PfNLInfoTypeFile,
*(_QWORD *)(*((_QWORD *)v1 + 2) + 16i64),
*(unsigned int *)(*((_QWORD *)v1 + 2) + 44i64),
(*(_DWORD *)(*((_QWORD *)v1 + 2) + 36i64) >> 3) & 1);
return;
case 8:
v54 = (int *)*((_QWORD *)v1 + 2);
v49 = (__int64 *)&v100;
v101 = 0;
v55 = *v54;
v100 = v54[1];
v102 = *((_QWORD *)v54 + 1);
v103 = (*((_QWORD *)v54 + 2) + 4095i64) & 0xFFFFFFFFFFFFF000ui64 | (2i64 * (v55 & 3));
v50 = ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24);
v51 = 24;
goto LABEL_52;
case 13:
v48 = (__int64 *)*((_QWORD *)v1 + 2);
if( !v48[1] )
goto LABEL_61;
v104[1] = v48[1];
v49 = v104;
StreamSequenceNumber = PfKernelGlobals.StreamSequenceNumber;
v104[0] = *v48;
v106 = 0;
v50 = ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24);
v51 = 31;
LABEL_52:
PfLogEvent(v51, dword_140C5001C + (v50 >> 10), v49, 0x18u);
return;
default:
goto LABEL_61;
}
goto LABEL_187;
}
v5 = *((_QWORD *)v1 + 2);
v6 = *(unsigned int *)(v5 + 16) + 4095i64;
v7 = (v6 + (unsigned __int64)(*(_DWORD *)(v5 + 8) & 0xFFF)) >> 12;
if( PfSnNumActiveTraces )
{
v27 = *(_ETHREAD **)(v5 + 32);
v28 = (v6 + (unsigned __int64)(*(_DWORD *)(v5 + 8) & 0xFFF)) >> 12;
v29 = *(_QWORD *)(v5 + 8);
v30 = *(_QWORD *)(v5 + 24);
FileObject = *(_FILE_OBJECT **)v5;
v31 = PfSnReferenceProcessTrace(v27->Tcb.Process);
v32 = v31;
if( v31 )
{
if( (unsigned int)PfSnCheckLoggingForThread(v27, v31, 0i64) )
{
v47 = v29 & 0xFFFFFFFFFFFFF000ui64;
if( v7 )
{
do
{
LODWORD(Flags) = 0;
if( PfSnLogPageFaultCommon(v32, FileObject, v30, v47, (UINT64)Flags) < 0 )
break;
v47 += 4096i64;
--v28;
}
while( v28 );
v1 = (_DWORD *)FileInfo;
}
}
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)v32 + 45);
}
}
if( *(&stru_140C4DB30 + 2044) < *(&stru_140C4DB30 + 2045) )
{
v8 = *((_QWORD *)v1 + 2);
v9 = *(_QWORD *)(v8 + 32);
v10 = *(int *)(v8 + 20);
v11 = *(_QWORD *)(v8 + 8);
v12 = *(_QWORD *)(v8 + 24);
v13 = *(_QWORD *)(v9 + 544);
v14 = (*(_DWORD *)(v9 + 1296) >> 12) & 7;
if( (*(_DWORD *)(v13 + 1124) & 0x100000) != 0 )
{
v56 = 2;
if( v14 < 2 )
v56 = (*(_DWORD *)(v9 + 1296) >> 12) & 7;
v14 = v56;
}
if( v14 < *(&stru_140C4DB30 + 655) )
{
v22 = 0;
goto LABEL_20;
}
v15 = *(_QWORD *)(v13 + 1088);
*(_QWORD *)&v108 = v7 | (v10 << 63);
v16 = 0i64;
v17 = 0i64;
v18 = (v15 ^ *(_QWORD *)(v13 + 1128)) & 0x1FFFFFFFFFFFFFFFi64;
*(_QWORD *)&v107 = v12;
*((_QWORD *)&v108 + 1) = v18;
v109 = __PAIR64__(v15, PfKernelGlobals.StreamSequenceNumber);
*((_QWORD *)&v107 + 1) = v11 >> 12;
v19 = dword_140C5001C
+ ((((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10);
if( ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&stru_140C4DB30 + 998) )
{
while( 1 )
{
for( j = RtlpInterlockedPopEntrySList((PSLIST_HEADER)&stru_140C4DB30 + 501);
!j;
j = RtlpInterlockedPopEntrySList((PSLIST_HEADER)&stru_140C4DB30 + 501) )
{
j = RtlpInterlockedPopEntrySList((PSLIST_HEADER)&stru_140C4DB30 + 500);
if( j )
break;
v22 = (*(&stru_140C4DB30 + 1009))((char *)&stru_140C4DB30 + 7984);
if( v22 < 0 )
goto LABEL_189;
}
v20 = *((_QWORD *)&j[1].Next + 1);
if( (__int64)j[2].Next - v20 >= 64 )
{
v17 = (unsigned __int64 *)*((_QWORD *)&j[1].Next + 1);
v16 = j;
v22 = 0;
goto LABEL_16;
}
if( !*((_DWORD *)&j[2].Next + 2) )
break;
(*(&stru_140C4DB30 + 1010))();
if( !ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&stru_140C4DB30 + 998) )
goto LABEL_184;
}
RtlpInterlockedPushEntrySList((PSLIST_HEADER)&stru_140C4DB30 + 500, j);
v22 = -1073741789;
LABEL_189:
++*(&stru_140C4DB30 + 2023);
*(&stru_140C4DB30 + 2024) += 64;
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&stru_140C4DB30 + 998);
LABEL_16:
if( v22 >= 0 )
{
v23 = *v17;
v24 = v107;
*((_DWORD *)v17 + 2) = v19;
v25 = v108;
*v17 = v23 & 0xFFFFFFFFFFFC0000ui64 | 0x2A013;
*((_OWORD *)v17 + 1) = v24;
*(_QWORD *)&v24 = v109;
*((_OWORD *)v17 + 2) = v25;
v17[6] = v24;
*((_QWORD *)&v16[1].Next + 1) += 64i64;
++*((_DWORD *)&v16[2].Next + 2);
Next = v16[1].Next;
if( (__int64)v16[2].Next - *((_QWORD *)&v16[1].Next + 1) < SLODWORD(Next[5].Next) )
{
((void(__fastcall *)(PSLIST_ENTRY))Next[6].Next)(v16);
}
else
{
RtlpInterlockedPushEntrySList((PSLIST_HEADER)&Next[2], v16);
ExReleaseRundownProtection((_EX_RUNDOWN_REF *)Next);
}
v22 = 0;
goto LABEL_20;
}
}
else
{
LABEL_184:
v22 = -1073741431;
}
_InterlockedExchangeAdd((_DWORD *)&xmmword_140C4FC10 + 1, 1u);
if( !v16 )
goto LABEL_20;
v92 = v16;
LABEL_187:
PfFbLogEntryComplete(v92, v20, 0i64);
goto LABEL_20;
}
LABEL_61:
if( (int)v1[1] <= 3 )
++dword_140C4FC24;
}
}Referenced by:
No references.