PfpQueryFileExtentsRequest
NTSTATUS __stdcall PfpQueryFileExtentsRequest(_SUPERFETCH_INFORMATION *Info, INT8 PreviousMode, UINT64 *ReturnSize){
VOID **PoolWithTag;
VOID **v6;
VOID **v7;
NTSTATUS inited;
__int64 v9;
__int128 v10;
__m128i v11;
size_t v12;
char *v13;
__int64 v14;
VOID **v15;
ULONG OutputBufferLength;
NTSTATUS VolumeInformationFile;
size_t Information;
VOID **OutputBuffer;
NTSTATUS v20;
NTSTATUS v21;
__int64 v22;
UINT64 FsInformationClass;
int v26;
size_t v27;
__int64 FileInformation;
_UNICODE_STRING DestinationString;
_IO_STATUS_BLOCK IoStatusBlock;
VOID *Src[2];
__m128i v32;
VOID *Address[2];
UINT64 NumberOfBytes;
__int64 InputBuffer;
_SUPERFETCH_INFORMATION *v36;
UINT64 *v37;
_HANDLE v38[2];
__int128 v39;
__int64 v40;
VOID *FileHandle;
__int128 v42;
__int64 v43;
__int128 FsInformation;
__int64 v45;
v37 = ReturnSize;
v36 = Info;
IoStatusBlock = 0i64;
InputBuffer = 0i64;
FileInformation = 0i64;
FsInformation = 0i64;
v45 = 0i64;
DestinationString = 0i64;
PoolWithTag = 0i64;
v6 = 0i64;
v7 = 0i64;
FileHandle = 0i64;
v42 = 0i64;
v43 = 0x200000000i64;
*(_QWORD *)v38 = 0i64;
v39 = 0i64;
v40 = 0x200000000i64;
v26 = 1;
if( (unsigned int)Info[6] < 0x38 )
{
LABEL_2:
inited = -1073741306;
goto LABEL_58;
}
if( PreviousMode )
ProbeForWrite(*((_QWORD *)Info + 2), 56i64, 8i64);
v9 = *((_QWORD *)Info + 2);
*(_OWORD *)Src = *(_OWORD *)v9;
v10 = *(_OWORD *)Src;
v11 = *(__m128i *)(v9 + 16);
v32 = v11;
*(_OWORD *)Address = *(_OWORD *)(v9 + 32);
NumberOfBytes = *(_QWORD *)(v9 + 48);
if( _mm_cvtsi128_si32(*(__m128i *)Src) != 2 )
{
inited = -1073741735;
goto LABEL_58;
}
v12 = _mm_cvtsi128_si32(v11);
if( (v12 & 1) != 0 || v12 - 1 > 0xFFFFF || (v11.m128i_i8[4] & 1) != 0 || !v11.m128i_i32[1] || v11.m128i_i32[1] >= v12 )
goto LABEL_57;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v12, 1883465296i64);
if( !PoolWithTag )
{
LABEL_13:
inited = -1073741670;
goto LABEL_58;
}
if( PreviousMode )
{
if( (_mm_cvtsi128_si32(_mm_srli_si128(*(__m128i *)Src, 8)) & 1) != 0 )
ExRaiseDatatypeMisalignment();
v13 = (char *)_mm_srli_si128(*(__m128i *)Src, 8).m128i_u64[0];
Src[1] = v13;
if( (unsigned __int64)&v13[v12] > 0x7FFFFFFF0000i64 || &v13[v12] < v13 )
MEMORY[0x7FFFFFFF0000] = 0;
}
memmove(PoolWithTag, Src[1], v12);
if( *((_WORD *)PoolWithTag + (v12 >> 1) - 1)
|| (v14 = (unsigned int)_mm_cvtsi128_si32(_mm_srli_si128(v11, 4)) >> 1, *((_WORD *)PoolWithTag + v14) != 92) )
{
LABEL_57:
inited = -1073741811;
goto LABEL_58;
}
v15 = ExAllocatePoolWithTag(0x200ui64, 0x90ui64, 1129539152i64);
v7 = v15;
if( !v15 )
goto LABEL_13;
PfpPrefetchSharedInitialize(v15);
*((_DWORD *)v7 + 14) = 15;
*((_DWORD *)v7 + 15) = 150;
inited = PfpPrefetchSharedStart(v7);
if( inited >= 0 )
{
*((_WORD *)PoolWithTag + v14) = 0;
inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)PoolWithTag);
if( inited >= 0 )
{
OutputBufferLength = 32;
inited = PfpOpenHandleCreate(
(__int64)&FileHandle,
(__int64)v7,
(__int64)&DestinationString,
0i64,
1048960,
0x20u,
0,
0i64);
if( inited >= 0 )
{
*((_WORD *)PoolWithTag + v14) = 92;
inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)PoolWithTag);
if( inited >= 0 )
{
inited = PfpOpenHandleCreate(
(__int64)v38,
(__int64)v7,
(__int64)&DestinationString,
0i64,
1048704,
0x20u,
0x80u,
(__int64)&FileHandle);
if( inited >= 0 )
{
LODWORD(FsInformationClass) = 1;
VolumeInformationFile = ZwQueryVolumeInformationFile(
(UINT64)FileHandle,
(UINT64)&IoStatusBlock,
(UINT64)&FsInformation,
0x18ui64,
FsInformationClass);
inited = VolumeInformationFile;
if( VolumeInformationFile == 259 )
KeBugCheckEx(0x191u, (PVOID)0xF72, 0i64, 0i64, 0i64);
if( (VolumeInformationFile & 0xC0000000) != -1073741824 )
{
LODWORD(Address[0]) = DWORD2(FsInformation);
Information = NumberOfBytes;
v27 = NumberOfBytes;
if( (unsigned int)NumberOfBytes > 0x20 )
OutputBufferLength = NumberOfBytes;
while( 1 )
{
if( OutputBufferLength > 0xA00000 )
goto LABEL_2;
if( v6 )
ExFreePoolWithTag(v6, 0);
OutputBuffer = ExAllocatePoolWithTag(1ui64, OutputBufferLength, 1699112528i64);
v6 = OutputBuffer;
if( !OutputBuffer )
goto LABEL_13;
v20 = ZwFsControlFile(
v38[0],
0,
0i64,
0i64,
&IoStatusBlock,
0x90073u,
&InputBuffer,
8u,
OutputBuffer,
OutputBufferLength);
inited = v20;
if( v20 == 259 )
KeBugCheckEx(0x191u, (PVOID)0xFB0, 0i64, 0i64, 0i64);
if( v20 >= 0 )
break;
if( v20 == -1073741807 )
goto LABEL_43;
if( v20 != -2147483643 )
goto LABEL_58;
OutputBufferLength *= 2;
}
Information = IoStatusBlock.Information;
LODWORD(NumberOfBytes) = IoStatusBlock.Information;
if( *(_DWORD *)v6 )
{
inited = 0;
LABEL_47:
v22 = *((_QWORD *)v36 + 2);
*(_OWORD *)v22 = v10;
*(__m128i *)(v22 + 16) = v11;
*(_OWORD *)(v22 + 32) = *(_OWORD *)Address;
*(_QWORD *)(v22 + 48) = NumberOfBytes;
if( inited == -1073741807 )
{
v26 = 0;
}
else if( v27 >= Information )
{
if( PreviousMode )
ProbeForWrite((UINT64)Address[1], Information, 8i64);
memmove(Address[1], v6, Information);
}
else
{
v26 = 0;
inited = -1073741789;
}
*(_DWORD *)v37 = 56;
goto LABEL_58;
}
LABEL_43:
v21 = ZwQueryInformationFile(
*(VOID **)v38,
&IoStatusBlock,
&FileInformation,
8ui64,
FileInternalInformation);
inited = v21;
if( v21 == 259 )
KeBugCheckEx(0x191u, (PVOID)0xFEB, 0i64, 0i64, 0i64);
if( v21 >= 0 )
{
v32.m128i_i64[1] = FileInformation;
inited = -1073741807;
v11 = v32;
goto LABEL_47;
}
}
}
}
}
}
}
LABEL_58:
if( v26 && (inited == -1073741807 || inited == -1073741789) )
inited = -1073741823;
if( (v40 & 0x400000000i64) != 0 )
PfpOpenHandleClose(v38, (__int64)v7);
if( (v43 & 0x400000000i64) != 0 )
PfpOpenHandleClose(&FileHandle, (__int64)v7);
if( v7 )
{
PfpPrefetchSharedCleanup(v7);
PfpPrefetchSharedDeref((_PFP_PREFETCH_CONTEXT_SHARED *)v7);
}
if( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
if( v6 )
ExFreePoolWithTag(v6, 0);
return inited;
}Referenced by:
PfQuerySuperfetchInformation