PfSnIsVolumeMounted
INT64 __fastcall PfSnIsVolumeMounted(wchar_t *VolumePath, UINT *VolumeMounted, UINT *RemovableMedia){
int v5;
int v6;
INT64 FsInformationClass;
UINT64 v9;
INT64 v10;
UINT64 ShareAccess;
INT64 ShareAccessa;
UINT64 CreateDisposition;
INT64 CreateDispositiona;
UINT64 CreateOptions;
UINT64 v16;
__int64 FsInformation;
struct _UNICODE_STRING DestinationString;
struct _IO_STATUS_BLOCK IoStatusBlock;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
void *FileHandle;
FileHandle = 0i64;
FsInformation = 0i64;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
DestinationString = 0i64;
IoStatusBlock = 0i64;
RtlInitUnicodeString(&DestinationString, VolumePath, (WCHAR)RemovableMedia);
LODWORD(v16) = 0;
ObjectAttributes.RootDirectory = 0i64;
LODWORD(CreateOptions) = 32;
LODWORD(CreateDisposition) = 1;
LODWORD(ShareAccess) = 7;
LODWORD(v9) = 0;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
ObjectAttributes.ObjectName = &DestinationString;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v5 = NtCreateFile(
&FileHandle,
0x100080ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
v9,
ShareAccess,
CreateDisposition,
CreateOptions,
0i64,
v16);
if( v5 >= 0 )
{
LODWORD(FsInformationClass) = 4;
v5 = NtQueryVolumeInformationFile(
FileHandle,
&IoStatusBlock,
&FsInformation,
8i64,
FsInformationClass,
v10,
ShareAccessa,
CreateDispositiona);
if( (v5 & 0xC0000000) != -1073741824 )
{
v6 = (HIDWORD(FsInformation) >> 5) & 1;
*RemovableMedia = BYTE4(FsInformation) & 1;
*VolumeMounted = v6;
v5 = 0;
}
NtClose(FileHandle);
}
return(unsigned int)v5;
}Referenced by:
PfSnOpenVolumesForPrefetch