FsRtlGetDirectImageOriginalBase

NTSTATUS __stdcall FsRtlGetDirectImageOriginalBase(_FILE_OBJECT *FileObject, PVOID *ImageOriginalBase){
  _DEVICE_OBJECT *v4; 
  UINT64 v5; 
  _IRP *Irp; 
  UINT64 v7; 
  NTSTATUS result; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  __int128 v10; 
  __int128 Object; 
  __int64 v12; 

  Object = 0i64;
  v12 = 0i64;
  v10 = 0i64;
  KeInitializeEvent((INT64)&Object, 0, 0);
  LODWORD(v4) = IoGetRelatedDeviceObject((INT64)FileObject);
  v5 = (UINT64)v4;
  Irp = IoAllocateIrpEx(v4, v4->StackSize, 0);
  v7 = (UINT64)Irp;
  if( !Irp )
    return -1073741670;
  Irp->RequestorMode = 0;
  Irp->AssociatedIrp.MasterIrp = (_IRP *)ImageOriginalBase;
  Irp->UserIosb = (_IO_STATUS_BLOCK *)&v10;
  Irp->UserEvent = (_KEVENT *)&Object;
  Irp->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
  CurrentStackLocation = Irp->Tail.CurrentStackLocation;
  CurrentStackLocation[-1].Parameters.Options = 0;
  *(_QWORD *)&CurrentStackLocation[-1].Parameters.EaLength = 0i64;
  *(_WORD *)&CurrentStackLocation[-1].MajorFunction = 13;
  CurrentStackLocation[-1].FileObject = FileObject;
  *(_DWORD *)&CurrentStackLocation[-1].Parameters.FileAttributes = 590756;
  LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = 8;
  result = IofCallDriver(v5, v7);
  if( result == 259 )
  {
    KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    return v10;
  }
  return result;
}

Referenced by: