PfSetSuperfetchInformation
INT64 __stdcall PfSetSuperfetchInformation(
_SYSTEM_INFORMATION_CLASS SystemInformationClass,
PVOID SystemInformation,
UINT64 SystemInformationLength,
CHAR PreviousMode){
int v5;
void *v7;
int v8;
int v9;
int v11;
unsigned int v12;
unsigned int v13;
unsigned int v14;
char *v15;
int v16;
INT64 v17;
unsigned int v18;
INT64 v19[2];
__int128 v20;
UINT64 ValueSize;
PVOID P;
__int64 v23;
int v24;
__int64 v25;
int v26;
void *Src[2];
unsigned int v28;
int v29;
unsigned __int64 v30;
__int64 v31;
INT64 v32[2];
__int128 v33;
UINT64 v34;
CHAR v35;
v35 = PreviousMode;
v5 = SystemInformationLength;
*(_OWORD *)v32 = 0i64;
v33 = 0i64;
v30 = 0i64;
LODWORD(ValueSize) = 0;
v25 = 0i64;
v26 = 0;
v23 = 0i64;
v24 = 0;
LODWORD(v34) = 0;
v31 = 0i64;
P = 0i64;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeProfileSingleProcessPrivilege, PreviousMode) )
{
v9 = -1073741790;
goto LABEL_12;
}
if( v5 != 32 )
{
v9 = -1073741820;
goto LABEL_12;
}
*(_OWORD *)v19 = 0i64;
v20 = 0i64;
*(_OWORD *)v19 = *(_OWORD *)SystemInformation;
v20 = *((_OWORD *)SystemInformation + 1);
if( v19[0] != 0x6B7568430000002Di64 )
goto LABEL_84;
if( LODWORD(v19[1]) == 14 )
{
v8 = PfpRpControlRequest((INT64)v19, PreviousMode);
goto LABEL_11;
}
if( SLODWORD(v19[1]) > 14 )
{
if( LODWORD(v19[1]) == 15 )
{
if( DWORD2(v20) != 4 )
goto LABEL_94;
if( PreviousMode && (v20 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v29 = *(_DWORD *)v20;
LODWORD(ValueSize) = v29 + dword_140C5001C;
v9 = PfpSetParameter(KeyHandle, (WCHAR *)L"BaseTime", v7, (UINT64)&ValueSize);
if( v9 >= 0 )
dword_140C5001C = ValueSize;
goto LABEL_12;
}
if( LODWORD(v19[1]) != 18 )
{
switch( LODWORD(v19[1]) )
{
case 0x13:
if( DWORD2(v20) == 12 )
{
v9 = 0;
if( PreviousMode && (v20 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v23 = *(_QWORD *)v20;
v11 = *(_DWORD *)(v20 + 8);
v24 = v11;
if( (_DWORD)v23 == 2 && SHIDWORD(v23) < 5 && (unsigned __int8)v24 <= 7u && BYTE1(v11) <= 7u && !HIWORD(v11) )
{
LOBYTE(v34) = BYTE4(v23);
BYTE1(v34) = v24;
WORD1(v34) = BYTE1(v11);
MmSetTrimWhileAgingState((unsigned int)v34);
goto LABEL_12;
}
goto LABEL_84;
}
goto LABEL_94;
case 0x16:
goto LABEL_10;
case 0x19:
if( DWORD2(v20) == 8 )
{
v9 = 0;
if( PreviousMode && (v20 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v31 = *(_QWORD *)v20;
if( (_DWORD)v31 == 1 )
{
MmSetMinimumAgeRate(HIDWORD(v31));
goto LABEL_12;
}
goto LABEL_84;
}
goto LABEL_94;
case 0x1A:
v8 = PfpDeprioritizeOldPagesInWs((__int64)v19, PreviousMode);
goto LABEL_11;
case 0x1D:
LABEL_10:
v8 = PfpPfnPrioRequest((INT64)v19, PreviousMode, &v34);
LABEL_11:
v9 = v8;
goto LABEL_12;
}
goto LABEL_101;
}
if( DWORD2(v20) != 12 )
goto LABEL_94;
if( PreviousMode && (v20 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v25 = *(_QWORD *)v20;
v16 = *(_DWORD *)(v20 + 8);
if( (_DWORD)v25 == 2 && HIDWORD(v25) < 2 && (v16 & 0xFFFFFFFC) == 0 )
{
PfLockExclusiveAcquire((UINT64)&PfTGlobals);
if( HIDWORD(v25) )
{
v18 = dword_140C4F908 & ~v16;
PfTCleanup((INT64)&PfTGlobals, v17);
PfTInitialize();
}
else
{
v18 = v16 & ~dword_140C4F908;
}
v9 = PfTStart((INT64)&PfTGlobals, v17, v18);
PfLockExclusiveRelease((UINT64)&PfTGlobals);
PfpScenCtxServiceThreadSet((volatile INT64 *)&qword_140C50020, HIDWORD(v25) == 0);
goto LABEL_12;
}
LABEL_84:
v9 = -1073741811;
goto LABEL_12;
}
switch( LODWORD(v19[1]) )
{
case 3:
v12 = 16;
if( DWORD2(v20) != 16 )
goto LABEL_94;
if( PreviousMode && (v20 & 7) != 0 )
ExRaiseDatatypeMisalignment();
*(_OWORD *)Src = *(_OWORD *)v20;
if( !Src[1] )
goto LABEL_84;
v13 = LODWORD(Src[0]) >> 7;
if( !(LODWORD(Src[0]) >> 7) )
goto LABEL_84;
v14 = (__int64)Src[0] & 0x1F;
if( v14 >= 2 )
{
if( v14 <= 3 )
{
v12 = 36;
goto LABEL_54;
}
if( v14 == 5 )
{
v12 = 12;
goto LABEL_54;
}
if( v14 == 27 )
{
LABEL_54:
if( v13 >= v12 && v13 < 0xFF0 )
{
P = ExAllocatePoolWithTag(PagedPool, v13, 0x44456650ui64);
if( P )
{
if( PreviousMode )
{
if( ((__int64)Src[1] & 1) != 0 )
ExRaiseDatatypeMisalignment();
v15 = (char *)Src[1] + ((unsigned __int64)LODWORD(Src[0]) >> 7);
if( (unsigned __int64)v15 > 0x7FFFFFFF0000i64 || v15 < Src[1] )
MEMORY[0x7FFFFFFF0000] = 0;
}
memmove((UINT8 *)P, (UINT8 *)Src[1], (unsigned __int64)LODWORD(Src[0]) >> 7);
Src[1] = P;
v8 = PfpLogEventRequest((INT64 *)Src);
goto LABEL_11;
}
v9 = -1073741670;
goto LABEL_12;
}
goto LABEL_84;
}
}
v9 = -1073741637;
goto LABEL_12;
case 4:
PfGenerateTrace((INT64)&Thread, 0i64);
v9 = 0;
goto LABEL_12;
case 5:
v8 = PfpPrefetchRequest((INT64)v19, PreviousMode);
goto LABEL_11;
case 7:
goto LABEL_10;
case 0xA:
if( DWORD2(v20) == 32 )
{
if( PreviousMode && (v20 & 7) != 0 )
ExRaiseDatatypeMisalignment();
*(_OWORD *)v32 = *(_OWORD *)v20;
v33 = *(_OWORD *)(v20 + 16);
v8 = PfpProcessScenarioPhase((INT64)v32, PreviousMode);
goto LABEL_11;
}
goto LABEL_94;
}
if( LODWORD(v19[1]) != 11 )
{
if( LODWORD(v19[1]) == 13 )
{
if( DWORD2(v20) == 8 )
{
if( PreviousMode && (v20 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v30 = *(_QWORD *)v20;
if( (_WORD)v30 == 1 && (unsigned int)(HIDWORD(v30) - 1) <= 4 )
{
v8 = PfpScenCtxPrefetchStateSet(
(CHAR *)&qword_140C50020,
HIDWORD(v30),
((unsigned int)(v30 >> 16) & 1) + 1,
0i64);
goto LABEL_11;
}
goto LABEL_84;
}
LABEL_94:
v9 = -1073741306;
goto LABEL_12;
}
LABEL_101:
v9 = -1073741821;
goto LABEL_12;
}
if( DWORD2(v20) != 4 )
goto LABEL_94;
if( PreviousMode && (v20 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v28 = *(_DWORD *)v20;
v9 = -1073741431;
if( PfTSetTraceWorkerPriority(v28) <= 31 )
v9 = 0;
LABEL_12:
if( P )
ExFreePoolWithTag(P, 0);
return(unsigned int)v9;
}Referenced by:
NtSetSystemInformation