RawMountVolume

NTSTATUS __stdcall RawMountVolume(_IO_STACK_LOCATION *IrpSp){
  __int64 v2; 
  NTSTATUS result; 
  PDEVICE_OBJECT v4; 
  unsigned int v5; 
  int v6; 
  _FILE_OBJECT *v7; 
  _ADAPTER_OBJECT *v8; 
  _KDEVICE_QUEUE *p_DeviceQueue; 
  __int64 v10; 
  INT64 DeviceCharacteristics; 
  PDEVICE_OBJECT DeviceObject; 
  _FILE_OBJECT *v13; 
  char Event[44]; 
  int v15; 
  int v16; 
  int v17; 
  wchar_t v18; 
  int v19; 

  DeviceObject = 0i64;
  RawScanDeletedList();
  v2 = *(_QWORD *)&IrpSp->Parameters.Options;
  if( *(_WORD *)(v2 + 304) > 0x1000u )
    return -1073741489;
  LODWORD(DeviceCharacteristics) = 0;
  result = IoCreateDevice(
             IrpSp->DeviceObject->DriverObject,
             0x150ui64,
             0i64,
             8ui64,
             DeviceCharacteristics,
             0,
             &DeviceObject);
  if( result >= 0 )
  {
    v4 = DeviceObject;
    v5 = *(_DWORD *)(v2 + 152);
    if( v5 > DeviceObject->AlignmentRequirement )
      DeviceObject->AlignmentRequirement = v5;
    v4->SectorSize = *(_WORD *)(v2 + 304);
    v4->Flags |= 0x10u;
    v6 = RawInitializeVcb(
           (_VCB *)&v4[1].Type,
           *(_DEVICE_OBJECT **)&IrpSp->Parameters.Options,
           (_VPB *)IrpSp->Parameters.SecurityContext);
    if( v6 < 0 )
    {
      RawCleanupVcb((_VCB *)&v4[1].Type);
      IoDeleteDevice(v4);
    }
    else
    {
      *(_QWORD *)(v4[1].DeviceQueue.Lock + 8) = v4;
      *(_DWORD *)(v4[1].DeviceQueue.Lock + 24) = -1;
      *(_WORD *)(v4[1].DeviceQueue.Lock + 6) = 0;
      v4->Flags &= ~0x80u;
      v4->StackSize = *(_BYTE *)(v2 + 76) + 1;
      v13 = 0i64;
      memset(&Event[4], 0, 20);
      v19 = 0;
      LODWORD(v7) = IoCreateStreamFileObjectLite(0i64, (INT64)v4);
      v8 = (_ADAPTER_OBJECT *)v7;
      v13 = v7;
      *(_DWORD *)&v4[1].gap4D[31] += 2;
      *(_DWORD *)&v4[1].gap4D[35] += 2;
      *(_DWORD *)Event = 4063233;
      *(_QWORD *)&Event[24] = 0i64;
      *(_DWORD *)&Event[32] = -1;
      *(_QWORD *)&Event[36] = 1i64;
      v15 = 6;
      v16 = 16;
      v17 = *(_DWORD *)L"RAW";
      v18 = aRaw[2];
      FsRtlNotifyVolumeEventEx(v7, 6ui64, (_TARGET_DEVICE_CUSTOM_NOTIFICATION *)Event);
      HalPutDmaAdapter(v8);
      *(_DWORD *)&v4[1].gap4D[31] -= 2;
      *(_DWORD *)&v4[1].gap4D[35] -= 2;
      ExAcquireFastMutex(&RawGlobalLock);
      p_DeviceQueue = &v4[1].DeviceQueue;
      v10 = RawMountedQueue;
      if( *(__int64 **)(RawMountedQueue + 8) != &RawMountedQueue )
        __fastfail(3u);
      *(_QWORD *)&p_DeviceQueue->Type = RawMountedQueue;
      p_DeviceQueue->DeviceListHead.Flink = (_LIST_ENTRY *)&RawMountedQueue;
      *(_QWORD *)(v10 + 8) = p_DeviceQueue;
      RawMountedQueue = (__int64)p_DeviceQueue;
      KeReleaseGuardedMutex(&RawGlobalLock);
    }
    return v6;
  }
  return result;
}

Referenced by: