PfpSourceGetPrefetchSupport

VOID __stdcall PfpSourceGetPrefetchSupport(UINT8 Rundown, GUID *SettingGuid, UINT64 ValueLength, PVOID Value){
  PVOID v4; 
  void *v5; 
  void *UniqueProcess; 
  __int64 v7; 
  int v8; 
  int v10; 
  void *v11; 
  int v12; 
  __int64 v13; 
  WCHAR v14; 
  int v15; 
  PVOID Object; 
  void *ProcessHandle; 
  struct _CLIENT_ID ClientId; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _UNICODE_STRING DestinationString; 
  wchar_t pszDest[40]; 
  v4 = 0i64;
  SettingGuid->Data1 = *(_DWORD *)Rundown;
  v5 = 0i64;
  Object = 0i64;
  UniqueProcess = 0i64;
  ProcessHandle = 0i64;
  v7 = Rundown;
  ClientId.UniqueProcess = 0i64;
  v8 = *(_DWORD *)Rundown;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  DestinationString = 0i64;
  if( !v8 )
  {
    *(_QWORD *)SettingGuid->Data4 = 0i64;
    goto LABEL_9;
  }
  v10 = v8 - 1;
  if( v10 )
  {
    if( v10 != 1 )
      return;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    ClientId.UniqueThread = 0i64;
    v11 = (void *)*(unsigned int *)(v7 + 4);
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    ClientId.UniqueProcess = v11;
    if( NtOpenProcess(&ProcessHandle, 0x1FFFFFui64, &ObjectAttributes, &ClientId) < 0 )
    {
      v5 = ProcessHandle;
LABEL_11:
      if( !v5 )
        return;
      NtClose(v5);
      goto LABEL_21;
    }
    v5 = ProcessHandle;
    v12 = ObpReferenceObjectByHandleWithTag(
            (ULONG_PTR)ProcessHandle,
            0x1FFFFF,
            (__int64)PsProcessType,
            0,
            0x73576650u,
            (__int64)&Object,
            0i64,
            0i64);
    v4 = Object;
    if( v12 >= 0 )
    {
      v13 = *(_QWORD *)(v7 + 16);
      if( !v13 || v13 == ((*((_QWORD *)Object + 136) ^ *((_QWORD *)Object + 141)) & 0x1FFFFFFFFFFFFFFFi64) )
      {
        *(_QWORD *)SettingGuid->Data4 = v5;
        v5 = 0i64;
      }
    }
LABEL_9:
    if( v4 )
      ObfDereferenceObjectWithTag(v4, 0x73576650ui64);
    goto LABEL_11;
  }
  RtlStringCbPrintfW(pszDest, 0x50ui64, (WCHAR *)L"\\KernelObjects\\Session%d");
  RtlInitUnicodeString(&DestinationString, pszDest, v14);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  NtOpenSession(&ClientId.UniqueProcess, 0xF0003ui64, &ObjectAttributes);
  if( v15 >= 0 )
  {
    *(_QWORD *)SettingGuid->Data4 = ClientId.UniqueProcess;
    goto LABEL_9;
  }
  UniqueProcess = ClientId.UniqueProcess;
LABEL_21:
  if( UniqueProcess )
    NtClose(UniqueProcess);
}

Referenced by: