FsRtlQueryCachedVdl

NTSTATUS __stdcall FsRtlQueryCachedVdl(_FILE_OBJECT *FileObject, INT64 *Vdl){
  _DEVICE_OBJECT *RelatedDeviceObject; 
  PIRP v5; 
  IRP *v6; 
  __int64 v7; 
  NTSTATUS Status; 
  int *v9; 
  __int64 v10; 
  struct _KEVENT Event; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  __m128i si128; 
  int v15; 
  memset(&Event, 0, sizeof(Event));
  IoStatusBlock = 0i64;
  KeInitializeEvent(&Event, NotificationEvent, 0);
  RelatedDeviceObject = IoGetRelatedDeviceObject(FileObject);
  v5 = IoBuildDeviceIoControlRequest(0x90284u, RelatedDeviceObject, 0i64, 0, 0i64, 0, 0, &Event, &IoStatusBlock);
  v6 = v5;
  if( !v5 )
    return -1073741670;
  si128 = _mm_load_si128((const __m128i *)&_xmm);
  v15 = 1;
  *((_QWORD *)v5 + 3) = &si128;
  v7 = *((_QWORD *)v5 + 23);
  *(_QWORD *)(v7 - 24) = FileObject;
  *(_BYTE *)(v7 - 72) = 13;
  *(_DWORD *)(v7 - 56) = 24;
  *(_DWORD *)(v7 - 64) = 64;
  Status = IofCallDriver(RelatedDeviceObject, v6);
  if( Status == 259 )
  {
    KeWaitForSingleObject(&Event, Executive, 0, 0, 0i64);
    Status = IoStatusBlock.Status;
  }
  if( (Status & 0xC0000000) != -1073741824 )
  {
    *Vdl = 0i64;
    if( si128.m128i_i32[2] )
    {
      v9 = &v15;
      v10 = si128.m128i_u32[2];
      do
      {
        if( (v9[4] & 1) != 0 )
          *Vdl = *(_QWORD *)v9 + *((_QWORD *)v9 + 1);
        v9 += 6;
        --v10;
      }
      while( v10 );
    }
  }
  return Status;
}

Referenced by: