NtQueryVolumeInformationFile

INT64 __fastcall NtQueryVolumeInformationFile(
        VOID *FileHandle,
        IO_STATUS_BLOCK *IoStatusBlock,
        VOID *FsInformation,
        INT64 Length,
        INT64 FsInformationClass,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  UINT64 v8; 
  unsigned int v11; 
  _ETHREAD *CurrentThread; 
  INT8 v13; 
  int v14; 
  unsigned int v15; 
  __int64 v16; 
  __int64 v17; 
  UINT64 v19; 
  __int16 v20; 
  INT64 result; 
  PADAPTER_OBJECT v22; 
  PIRP v23; 
  POOL_TYPE v24; 
  UINT8 MountFlag; 
  _DMA_OPERATIONS *DmaOperations; 
  int FreeAdapterChannel_high; 
  unsigned int v28; 
  _ETHREAD *v29; 
  PADAPTER_OBJECT v30; 
  __int64 v31; 
  _DEVICE_OBJECT *RelatedDeviceObject; 
  UINT64 v33; 
  IRP *v34; 
  IRP *v35; 
  IO_STATUS_BLOCK *p_LocalIoStatus; 
  PVOID v37; 
  __int64 v38; 
  _WORD *PoolWithQuota; 
  __int64 v40; 
  _KEVENT *Pool; 
  _FILE_FS_DRIVER_PATH_INFORMATION *v42; 
  int DriverPathInformation; 
  unsigned int v44; 
  UINT64 v45; 
  CHAR v46; 
  unsigned __int8 v47; 
  PADAPTER_OBJECT DmaAdapter; 
  PVOID P; 
  PDEVICE_OBJECT DeviceObject; 
  PIRP Irp; 
  _ETHREAD *v52; 
  _FILE_FS_DRIVER_PATH_INFORMATION *v53; 
  _IO_STATUS_BLOCK LocalIoStatus; 
  VOID *retaddr; 
  v8 = (unsigned int)Length;
  v11 = 0;
  DmaAdapter = 0i64;
  P = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v52 = CurrentThread;
  v13 = *((_BYTE *)CurrentThread + 562);
  v47 = v13;
  if( v13 )
  {
    v14 = FsInformationClass;
    if( (unsigned int)FsInformationClass >= 0xF )
      return 3221225475i64;
    v15 = *((unsigned __int8 *)IopQueryFsOperationLength + (int)FsInformationClass);
    if( !(_BYTE)v15 )
      return 3221225475i64;
    if( (unsigned int)Length < v15 )
      return 3221225476i64;
    v16 = (__int64)IoStatusBlock;
    if( (unsigned __int64)IoStatusBlock >= 0x7FFFFFFF0000i64 )
      v16 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v16 = *(_DWORD *)v16;
    v17 = *(_QWORD *)(*((_QWORD *)CurrentThread + 23) + 1408i64);
    if( v17 && ((v20 = *(_WORD *)(v17 + 8), v20 == 332) || v20 == 452) )
      v19 = 4i64;
    else
      v19 = *((unsigned __int8 *)IopQuerySetFsAlignmentRequirement + (int)FsInformationClass);
    ProbeForWrite(FsInformation, (unsigned int)Length, v19);
  }
  else
  {
    v14 = FsInformationClass;
  }
  LODWORD(result) = IopReferenceFileObject(
                      FileHandle,
                      (unsigned int)IopQueryFsOperationAccess[v14],
                      v13,
                      (FILE_OBJECT **)&DmaAdapter,
                      0i64);
  if( (int)result < 0 )
    return result;
  v22 = DmaAdapter;
  v23 = (PIRP)&DmaAdapter[5];
  Irp = (PIRP)&DmaAdapter[5];
  v24 = *(_DWORD *)&DmaAdapter[5].Version;
  if( (v24 & 0x800) != 0 )
  {
    if( v14 != 4 )
    {
      HalPutDmaAdapter(DmaAdapter);
      return 3221225488i64;
    }
LABEL_20:
    if( (*(_DWORD *)&DmaAdapter[5].Version & 0x800) != 0 || LODWORD(DmaAdapter->DmaOperations->GetDmaAlignment) != 20 )
    {
      MountFlag = 0;
      DmaOperations = DmaAdapter->DmaOperations;
      if( DmaOperations->FreeMapRegisters )
        MountFlag = IopGetMountFlag((DEVICE_OBJECT *)DmaAdapter->DmaOperations);
      if( (unsigned int)v8 < 8 )
      {
        v11 = -1073741820;
      }
      else
      {
        *(_DWORD *)FsInformation = DmaOperations->GetDmaAlignment;
        FreeAdapterChannel_high = HIDWORD(DmaOperations->FreeAdapterChannel);
        *((_DWORD *)FsInformation + 1) = FreeAdapterChannel_high;
        if( MountFlag )
          *((_DWORD *)FsInformation + 1) = FreeAdapterChannel_high | 0x20;
        IoStatusBlock->Status = 0;
        IoStatusBlock->Information = 8i64;
      }
      HalPutDmaAdapter(v22);
      return v11;
    }
    goto LABEL_30;
  }
  if( v14 == 4 )
    goto LABEL_20;
LABEL_30:
  if( (v24 & 2) != 0 )
  {
    v28 = (unsigned int)v24 >> 2;
    LOBYTE(v28) = v28 & 1;
    LODWORD(DeviceObject) = v28;
    v29 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v29 + 242);
    v30 = DmaAdapter;
    LODWORD(v31) = KeAbPreAcquire(&DmaAdapter[8], 0i64, 0i64);
    if( _InterlockedExchange((volatile __int32 *)(&v30[7].Size + 1), 1) )
    {
      v22 = DmaAdapter;
      IopWaitAndAcquireFileObjectLock(DmaAdapter, v47);
    }
    else
    {
      if( v31 )
        *(_BYTE *)(v31 + 26) |= 1u;
      v22 = DmaAdapter;
      ObfReferenceObject(DmaAdapter);
    }
    v46 = 1;
    v23 = Irp;
  }
  else
  {
    v46 = 0;
  }
  if( v14 != 9 )
  {
    IopResetEvent((FILE_OBJECT *)v22);
    RelatedDeviceObject = IoGetRelatedDeviceObject((_FILE_OBJECT *)v22);
    DeviceObject = RelatedDeviceObject;
    if( (*(_DWORD *)v23 & 2) == 0 )
    {
      Pool = (_KEVENT *)IopVerifierExAllocatePool((POOL_TYPE)*(_DWORD *)v23, v33);
      P = Pool;
      if( !Pool )
      {
        HalPutDmaAdapter(v22);
        return 3221225626i64;
      }
      KeInitializeEvent(Pool, SynchronizationEvent, 0);
      RelatedDeviceObject = DeviceObject;
    }
    v34 = IopAllocateIrpExReturn(RelatedDeviceObject, *((_BYTE *)RelatedDeviceObject + 76), 0, retaddr);
    Irp = v34;
    if( v34 )
    {
      v35 = v34;
      *((_QWORD *)v34 + 24) = v22;
      *((_QWORD *)v34 + 19) = v52;
      *((_BYTE *)v34 + 64) = v47;
      LocalIoStatus = 0i64;
      if( v46 )
      {
        p_LocalIoStatus = IoStatusBlock;
        v37 = 0i64;
      }
      else
      {
        *((_DWORD *)v34 + 4) = 4;
        p_LocalIoStatus = &LocalIoStatus;
        v37 = P;
      }
      *((_QWORD *)v35 + 10) = v37;
      *((_QWORD *)v35 + 9) = p_LocalIoStatus;
      *((_QWORD *)v35 + 11) = 0i64;
      v38 = *((_QWORD *)v35 + 23) - 72i64;
      v52 = (_ETHREAD *)v38;
      *(_BYTE *)v38 = 10;
      *(_QWORD *)(v38 + 48) = v22;
      *((_QWORD *)v35 + 14) = FsInformation;
      *((_QWORD *)v35 + 3) = 0i64;
      *((_QWORD *)v35 + 1) = 0i64;
      PoolWithQuota = IopVerifierExAllocatePoolWithQuota((POOL_TYPE)v37, v8);
      *((_QWORD *)v35 + 3) = PoolWithQuota;
      if( !IopDisableBufferedIoInit )
        memset((INT64)PoolWithQuota, 0i64);
      *((_DWORD *)v35 + 4) |= 0x870u;
      v40 = (__int64)v52;
      *((_DWORD *)v52 + 2) = v8;
      *(_DWORD *)(v40 + 16) = v14;
      LODWORD(v45) = 2;
      result = IopSynchronousServiceTail(DeviceObject, v35, (FILE_OBJECT *)v22, 1, v47, v46, v45);
      if( !v46 )
        LODWORD(result) = IopSynchronousApiServiceTail(
                            (unsigned int)result,
                            (_KEVENT *)P,
                            v35,
                            v47,
                            &LocalIoStatus,
                            IoStatusBlock);
      return result;
    }
    if( (*(_DWORD *)v23 & 2) == 0 )
      ExFreePoolWithTag(P, 0);
    IopAllocateIrpCleanup((PUNICODE_STRING)v22);
    return 3221225626i64;
  }
  v53 = 0i64;
  v42 = (_FILE_FS_DRIVER_PATH_INFORMATION *)IopVerifierExAllocatePoolWithQuota(v24, v8);
  v53 = v42;
  memmove(&v42->DriverInPath, (UINT8 *)FsInformation, v8);
  DriverPathInformation = IopGetDriverPathInformation((_FILE_OBJECT *)v22, v42, (unsigned int)v8);
  v44 = DriverPathInformation;
  if( DriverPathInformation < 0 )
    RtlRaiseStatus(DriverPathInformation);
  *(_BYTE *)FsInformation = v42->DriverInPath;
  IoStatusBlock->Status = 0;
  IoStatusBlock->Information = 12i64;
  if( v42 )
    ExFreePoolWithTag(v42, 0);
  if( (*(_DWORD *)&v22[5].Version & 2) != 0 )
    IopReleaseFileObjectLock(v22);
  HalPutDmaAdapter(v22);
  return v44;
}

Referenced by: