RawQueryVolumeInformation
INT64 __fastcall RawQueryVolumeInformation(INT64 a1, IRP *a2, INT64 a3){
unsigned int v3;
INT64 v5;
NTSTATUS v7;
NTSTATUS SectorSizeInformation;
unsigned int v9;
unsigned int a4;
v3 = *(_DWORD *)(a3 + 8);
v5 = *((_QWORD *)a2 + 3);
a4 = v3;
switch( *(_DWORD *)(a3 + 16) )
{
case 1:
v7 = RawQueryFsVolumeInfo(a1, *(_QWORD *)(a3 + 48), v5, &a4);
LABEL_3:
v3 = a4;
SectorSizeInformation = v7;
break;
case 3:
v7 = RawQueryFsSizeInfo(a1, *(_QWORD *)(a3 + 48), v5, &a4);
goto LABEL_3;
case 4:
v7 = RawQueryFsDeviceInfo(a1, *(_QWORD *)(a3 + 48), v5, &a4);
goto LABEL_3;
case 5:
if( v3 < 0x12 )
{
SectorSizeInformation = -2147483643;
}
else
{
*(_DWORD *)v5 = 0;
v3 -= 18;
*(_DWORD *)(v5 + 4) = 0;
*(_DWORD *)(v5 + 8) = 6;
SectorSizeInformation = 0;
*(_DWORD *)(v5 + 12) = *(_DWORD *)L"RAW";
*(_WORD *)(v5 + 16) = aRaw[2];
}
break;
case 0xB:
SectorSizeInformation = FsRtlGetSectorSizeInformation(
*(DEVICE_OBJECT **)(*(_QWORD *)(a1 + 184) + 16i64),
(FILE_FS_SECTOR_SIZE_INFORMATION *)v5);
if( SectorSizeInformation >= 0 )
v3 -= 28;
break;
default:
SectorSizeInformation = -1073741811;
break;
}
v9 = *(_DWORD *)(a3 + 8) - v3;
*((_DWORD *)a2 + 12) = SectorSizeInformation;
*((_QWORD *)a2 + 7) = v9;
IofCompleteRequest(a2, 1);
return(unsigned int)SectorSizeInformation;
}Referenced by:
RawDispatch