PfSnPrefetchMetadata

__int64 __fastcall PfSnPrefetchMetadata(__int64 a1, INT64 a2, EVENT_DESCRIPTOR *r8_0){
  INT64 v3; 
  int v4; 
  unsigned int v6; 
  NTSTATUS v7; 
  __int64 v8; 
  __int64 v9; 
  LIST_ENTRY *v10; 
  unsigned int *v11; 
  LIST_ENTRY *PrefetchVolumeInfoInList; 
  LIST_ENTRY *v13; 
  _DWORD *v14; 
  unsigned int i; 
  WCHAR v16; 
  UINT64 v17; 
  int v18; 
  int v19; 
  unsigned int v20; 
  _QWORD *v21; 
  unsigned int v22; 
  _LIST_ENTRY *Flink; 
  unsigned int v24; 
  unsigned int v25; 
  unsigned int *v26; 
  UINT64 v27; 
  unsigned int v29; 
  INT64 v30; 
  __int64 v31; 
  __int64 v32; 
  __int64 v33; 
  INT64 a4[2]; 
  __int64 v35; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 a3; 
  INT64 v38; 
  __int64 v39; 
  struct _UNICODE_STRING DestinationString; 
  unsigned int v41; 
  unsigned int v42; 
  int v43; 
  void *EventHandle; 
  v42 = a2;
  v3 = *(_QWORD *)a1;
  v4 = 0;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v38 = v3;
  EventHandle = 0i64;
  v35 = 0i64;
  LOBYTE(r8_0) = 1;
  v6 = a2;
  DestinationString = 0i64;
  *(_OWORD *)a4 = 0i64;
  PfSnLogPrefetchMetadata(v3, a2, r8_0);
  if( v3 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 512;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v7 = NtCreateEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes, NotificationEvent, 0);
    if( v7 >= 0 )
    {
      v8 = v3 + *(unsigned int *)(v3 + 108);
      v9 = 0i64;
      v39 = v8;
      v43 = 0;
      if( *(_DWORD *)(v3 + 112) )
      {
        v10 = (LIST_ENTRY *)(a1 + 40);
        do
        {
          v11 = (unsigned int *)(v8 + 96 * v9);
          PrefetchVolumeInfoInList = PfSnFindPrefetchVolumeInfoInList((const WCHAR *)(v8 + *v11), v10, 1ui64);
          v13 = PrefetchVolumeInfoInList;
          if( PrefetchVolumeInfoInList && (HIDWORD(PrefetchVolumeInfoInList[6].Blink) & 1) != 0 )
          {
            v14 = v11 + 9;
            for( i = 0; i < 7; ++i )
            {
              if( _bittest((const int *)&v6, i) )
                v4 += *v14 + v14[7];
              ++v14;
            }
            PfSnPrefetchFileMetadata(
              a1,
              PrefetchVolumeInfoInList[2].Flink,
              v8 + v11[5],
              (unsigned int)PrefetchVolumeInfoInList[6].Blink,
              v4,
              EventHandle);
            LODWORD(v13[6].Blink) += v4;
            v16 = 768;
            v17 = *(_QWORD *)(a1 + 80);
            a3 = v17;
            *(_DWORD *)v17 = 4;
            v18 = *(_DWORD *)(a1 + 96);
            v19 = *(_DWORD *)(a1 + 100) & 7 | 8;
            *(_DWORD *)(v17 + 4) = 768;
            *(_QWORD *)(v17 + 8) = v18 & 7 | (unsigned __int64)(unsigned int)(8 * v19);
            v20 = 0;
            v21 = (_QWORD *)(v17 + 16);
            do
            {
              v22 = v20++;
              *v21++ = v22 << 12;
            }
            while( v20 < 0x300 );
            Flink = v13[6].Flink;
            v24 = 0;
            v25 = v42;
            v26 = v11 + 16;
            v27 = a3;
            v41 = 0;
            do
            {
              if( _bittest((const int *)&v25, v24) )
              {
                v29 = 0;
                if( *v26 )
                {
                  do
                  {
                    RtlInitUnicodeString(&DestinationString, (PCWSTR)&Flink->Flink + LODWORD(v13[1].Blink) + 2, v16);
                    v30 = *(_QWORD *)(a1 + 8);
                    ObjectAttributes.RootDirectory = v13[4].Flink;
                    ObjectAttributes.Length = 48;
                    ObjectAttributes.ObjectName = &DestinationString;
                    ObjectAttributes.Attributes = 576;
                    v35 = 0i64;
                    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
                    *(_OWORD *)a4 = 0i64;
                    PfpPrefetchEntireDirectory(v30, (INT64)&v13[2], v27, (INT64)a4, (INT64)&ObjectAttributes);
                    if( a4[0] && *(_DWORD *)(a1 + 120) < *(_DWORD *)(a1 + 124) )
                    {
                      v31 = v35;
                      v32 = 3i64 * *(unsigned int *)(a1 + 120);
                      v33 = *(_QWORD *)(a1 + 112);
                      *(_OWORD *)(v33 + 8 * v32) = *(_OWORD *)a4;
                      *(_QWORD *)(v33 + 8 * v32 + 16) = v31;
                      ++*(_DWORD *)(a1 + 120);
                    }
                    ++v29;
                    Flink = (_LIST_ENTRY *)((char *)Flink + 2 * LOWORD(Flink->Flink) + 4);
                  }
                  while( v29 < *v26 );
                  v24 = v41;
                  v25 = v42;
                }
              }
              ++v24;
              ++v26;
              v41 = v24;
            }
            while( v24 < 7 );
            v3 = v38;
            v4 = 0;
            v8 = v39;
            v13[6].Flink = Flink;
            v6 = v42;
          }
          v10 = (LIST_ENTRY *)(a1 + 40);
          v9 = (unsigned int)(v43 + 1);
          v43 = v9;
        }
        while( (unsigned int)v9 < *(_DWORD *)(v3 + 112) );
      }
      v7 = 0;
    }
    if( EventHandle )
      NtClose(EventHandle);
  }
  else
  {
    v7 = -1073741811;
  }
  PfSnLogPrefetchMetadata(v3, v6, 0i64);
  return(unsigned int)v7;
}

Referenced by: