NtSetEaFile

NTSTATUS __fastcall NtSetEaFile(UINT64 a1, UINT64 a2, UINT64 a3, UINT64 a4){
  _IO_STATUS_BLOCK *p_LocalIoStatus; 
  _KEVENT *v7; 
  INT8 PreviousMode; 
  UINT64 v9; 
  UINT64 v10; 
  NTSTATUS result; 
  _FILE_OBJECT *v12; 
  unsigned int *p_Flags; 
  bool v14; 
  _ETHREAD *v15; 
  _FILE_OBJECT *v16; 
  _BYTE *v17; 
  int v18; 
  _DEVICE_OBJECT *v19; 
  _IRP *v20; 
  _IRP *v21; 
  char RequestorMode; 
  _KEVENT *v23; 
  _IO_STACK_LOCATION *v24; 
  unsigned int Flags; 
  size_t v26; 
  UINT8 v27; 
  VOID **Pool_3; 
  _FILE_FULL_EA_INFORMATION *PoolWithQuota; 
  int v30; 
  _MDL *Mdl; 
  UINT8 SynchronousIo; 
  INT8 v33; 
  char v34; 
  NTSTATUS v35; 
  _FILE_OBJECT *pFileObject; 
  unsigned int ErrorOffset; 
  PVOID KernelEvent; 
  PDEVICE_OBJECT DeviceObject; 
  _ETHREAD *CurrentThread; 
  PIRP Irp; 
  _IO_STATUS_BLOCK LocalIoStatus; 
  VOID *retaddr; 
  size_t Size; 

  Size = a4;
  p_LocalIoStatus = (_IO_STATUS_BLOCK *)a2;
  pFileObject = 0i64;
  v7 = 0i64;
  KernelEvent = 0i64;
  LocalIoStatus = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  v33 = PreviousMode;
  if( PreviousMode )
  {
    v9 = 0x7FFFFFFF0000i64;
    if( a2 < 0x7FFFFFFF0000i64 )
      v9 = a2;
    *(_DWORD *)v9 = *(_DWORD *)v9;
    if( (_DWORD)a4 )
    {
      if( (a3 & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v10 = a3 + (unsigned int)a4;
      if( v10 > 0x7FFFFFFF0000i64 || v10 < a3 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  result = IopReferenceFileObject((VOID *)a1, 0x10ui64, PreviousMode, &pFileObject, 0i64);
  v35 = result;
  if( result >= 0 )
  {
    v12 = pFileObject;
    p_Flags = &pFileObject->Flags;
    if( (pFileObject->Flags & 2) != 0 )
    {
      v14 = (pFileObject->Flags & 4) != 0;
      v15 = (_ETHREAD *)KeGetCurrentThread();
      --v15->Tcb.KernelApcDisable;
      v16 = pFileObject;
      v17 = KeAbPreAcquire(pFileObject->gap80, 0i64, 0i64);
      SynchronousIo = 0;
      if( _InterlockedExchange((volatile __int32 *)&v16->Busy, 1) )
      {
        v12 = pFileObject;
        v18 = IopWaitAndAcquireFileObjectLock(pFileObject, PreviousMode, v14, v17, (INT64)&SynchronousIo);
      }
      else
      {
        if( v17 )
          v17[26] |= 1u;
        v12 = pFileObject;
        ObfReferenceObject(pFileObject);
        v18 = 0;
      }
      v35 = v18;
      if( !SynchronousIo )
      {
        SynchronousIo = 1;
        p_LocalIoStatus = (_IO_STATUS_BLOCK *)a2;
        goto LABEL_18;
      }
    }
    else
    {
      Pool_3 = IopVerifierExAllocatePool_3();
      v7 = (_KEVENT *)Pool_3;
      KernelEvent = Pool_3;
      if( Pool_3 )
      {
        KeInitializeEvent((INT64)Pool_3, 1, 0);
        SynchronousIo = 0;
LABEL_18:
        IopResetEvent(v12);
        LODWORD(v19) = IoGetRelatedDeviceObject((INT64)v12);
        DeviceObject = v19;
        v20 = IopAllocateIrpExReturn(v19, v19->StackSize, 0, retaddr);
        v21 = v20;
        Irp = v20;
        if( v20 )
        {
          v20->Tail.OriginalFileObject = v12;
          v20->Tail.Thread = CurrentThread;
          RequestorMode = v33;
          v20->RequestorMode = v33;
          if( SynchronousIo )
          {
            v23 = 0i64;
          }
          else
          {
            v20->Flags = 4;
            p_LocalIoStatus = &LocalIoStatus;
            v23 = v7;
          }
          v21->UserEvent = v23;
          v21->UserIosb = p_LocalIoStatus;
          v21->Overlay.UserApcRoutine = 0i64;
          v24 = v21->Tail.CurrentStackLocation - 1;
          CurrentThread = (_ETHREAD *)v24;
          v24->MajorFunction = 8;
          v24->FileObject = v12;
          Flags = DeviceObject->Flags;
          if( (Flags & 4) != 0 )
          {
            ErrorOffset = 0;
            v26 = Size;
            if( Size )
            {
              v34 = 0;
              PoolWithQuota = (_FILE_FULL_EA_INFORMATION *)IopVerifierExAllocatePoolWithQuota(0i64, Size);
              v21->AssociatedIrp.MasterIrp = (_IRP *)PoolWithQuota;
              memmove(PoolWithQuota, (const VOID *)a3, Size);
              v30 = IoCheckEaBufferValidity(PoolWithQuota, Size, &ErrorOffset);
              v35 = v30;
              if( v30 < 0 )
              {
                v34 = 1;
                *(_DWORD *)a2 = v30;
                *(_QWORD *)(a2 + 8) = ErrorOffset;
                RtlRaiseStatus(v30);
              }
              v21->Flags |= 0x30u;
              RequestorMode = v33;
              v24 = (_IO_STACK_LOCATION *)CurrentThread;
            }
            else
            {
              v21->AssociatedIrp.MasterIrp = 0i64;
            }
          }
          else
          {
            v26 = Size;
            if( (Flags & 0x10) != 0 )
            {
              if( Size )
              {
                Mdl = IoAllocateMdl((VOID *)a3, Size, 0, 1u, v21);
                if( !Mdl )
                  RtlRaiseStatus(-1073741670);
                IopProbeAndLockPages_2(Mdl, RequestorMode, 0, DeviceObject, v24->MajorFunction);
              }
            }
            else
            {
              v21->UserBuffer = (void *)a3;
            }
          }
          LODWORD(v24->Parameters.SecurityContext) = v26;
          v27 = SynchronousIo;
          result = IopSynchronousServiceTail(DeviceObject, v21, v12, 0, RequestorMode, SynchronousIo, OtherTransfer);
          if( !v27 )
            return IopSynchronousApiServiceTail(
                     (unsigned int)result,
                     v7,
                     v21,
                     RequestorMode,
                     &LocalIoStatus,
                     (_IO_STATUS_BLOCK *)a2);
        }
        else
        {
          if( (*p_Flags & 2) == 0 )
            ExFreePoolWithTag(v7, 0);
          IopAllocateIrpCleanup(v12, 0i64);
          return -1073741670;
        }
        return result;
      }
      v18 = -1073741670;
    }
    HalPutDmaAdapter((PADAPTER_OBJECT)v12);
    return v18;
  }
  return result;
}

Referenced by: