SmKmStoreFileWriteHeader

__int64 __fastcall SmKmStoreFileWriteHeader(__int64 a1, int a2){
  _MMPFN *v4; 
  UINT8 v5; 
  void *NonPaged; 
  INT64 v7; 
  NTSTATUS Status; 
  _MDL *Mdl; 
  UINT64 v10; 
  _MMPTE *v11; 
  void *v12; 
  NTSTATUS v13; 
  struct _KEVENT *p_Event; 
  UINT64 FileInformationClass; 
  _MMPFN **Buffer; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  union _LARGE_INTEGER StartingOffset; 
  struct _KEVENT Event; 
  __int128 FileInformation; 
  __int64 v22; 
  StartingOffset.QuadPart = 0i64;
  v22 = 0i64;
  IoStatusBlock = 0i64;
  v4 = 0i64;
  FileInformation = 0i64;
  v5 = IoSetThreadHardErrorMode(0);
  NonPaged = (void *)SSHSupportAllocateNonPaged(0x10000ui64, 0x68466D73u);
  v7 = (INT64)NonPaged;
  if( !NonPaged )
  {
    Status = -1073741670;
    goto LABEL_19;
  }
  if( !a2 )
  {
    Mdl = MmCreateMdl(0i64, NonPaged, 0x10000ui64);
    v4 = (_MMPFN *)Mdl;
    if( !Mdl )
    {
      Status = -1073741670;
      goto LABEL_17;
    }
    MmBuildMdlForNonPagedPool(Mdl);
    MmMdlPageContentsState(v4, (_MMPTE *)1, v10, v11, FileInformationClass, Buffer);
  }
  memset(v7, 0i64);
  *(_DWORD *)v7 = 1164135783;
  *(_DWORD *)(v7 + 4) = 3;
  *(_DWORD *)(v7 + 40) = 1;
  *(_DWORD *)(v7 + 8) = RtlComputeCrc32(0i64, (UINT8 *)v7, 0x30ui64);
  v12 = *(void **)a1;
  if( a2 )
  {
    v13 = ZwWriteFile(v12, 0i64, 0i64, 0i64, &IoStatusBlock, (PVOID)v7, 0x10000u, &StartingOffset, 0i64);
    p_Event = (struct _KEVENT *)(*(_QWORD *)(a1 + 8) + 152i64);
  }
  else
  {
    Status = ZwQueryInformationFile(v12, &IoStatusBlock, &FileInformation, 0x18ui64, FileStandardInformation);
    if( Status == 259 )
    {
      KeWaitForSingleObject((PVOID)(*(_QWORD *)(a1 + 8) + 152i64), Executive, 0, 0, 0i64);
      Status = IoStatusBlock.Status;
    }
    if( Status < 0 )
      goto LABEL_17;
    KeInitializeEvent(&Event, NotificationEvent, 0);
    v13 = IoSynchronousPageWrite(*(PFILE_OBJECT *)(a1 + 8), (PMDL)v4, &StartingOffset, &Event, &IoStatusBlock);
    p_Event = &Event;
  }
  Status = v13;
  if( v13 == 259 )
  {
    KeWaitForSingleObject(p_Event, Executive, 0, 0, 0i64);
    Status = IoStatusBlock.Status;
  }
  if( Status >= 0 )
    Status = IoStatusBlock.Information != 0x10000 ? 0xC000016A : 0;
LABEL_17:
  CmSiFreeMemory((PPRIVILEGE_SET)v7);
  if( v4 )
    ExFreePoolWithTag(v4, 0);
LABEL_19:
  IoSetThreadHardErrorMode(v5);
  return(unsigned int)Status;
}

Referenced by: