FsRtlKernelFsControlFile

NTSTATUS __stdcall FsRtlKernelFsControlFile(
        _FILE_OBJECT *FileObject,
        UINT64 FsControlCode,
        VOID *InputBuffer,
        UINT64 InputBufferLength,
        VOID *OutputBuffer,
        UINT64 OutputBufferLength,
        UINT64 *RetOutputBufferSize){
  size_t v7; 
  int v9; 
  _IRP *v11; 
  unsigned int v12; 
  _DEVICE_OBJECT *v13; 
  _IRP *v14; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  size_t v16; 
  _IO_STACK_LOCATION *v17; 
  NTSTATUS Status; 
  unsigned int Information; 
  _MDL *Mdl; 
  void *v21; 
  void *v22; 
  void *v23; 
  _MDL *MdlAddress; 
  _IRP *Irp; 
  $53AF3F349F2CB9475F75F7184FEA4434 *v27; 
  _DEVICE_OBJECT *DeviceObject; 
  VOID *ObjectArray; 
  __int128 Object; 
  __int64 v31; 

  v7 = InputBufferLength;
  v9 = FsControlCode;
  v11 = 0i64;
  Object = 0i64;
  v31 = 0i64;
  KeInitializeEvent((INT64)&Object, 0, 0);
  v12 = v9 & 3;
  if( (FileObject->Flags & 0x800) != 0 )
  {
    Status = -1073741808;
    goto LABEL_32;
  }
  LODWORD(v13) = IoGetRelatedDeviceObject((INT64)FileObject);
  DeviceObject = v13;
  v14 = IoAllocateIrpEx(v13, v13->StackSize, 0);
  v11 = v14;
  Irp = v14;
  if( !v14 )
    goto LABEL_21;
  v27 = &v14->Tail.64;
  CurrentStackLocation = v14->Tail.CurrentStackLocation;
  *(_WORD *)&CurrentStackLocation[-1].MajorFunction = 1037;
  CurrentStackLocation[-1].FileObject = FileObject;
  v16 = OutputBufferLength;
  LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = OutputBufferLength;
  CurrentStackLocation[-1].Parameters.Options = v7;
  *(_DWORD *)&CurrentStackLocation[-1].Parameters.FileAttributes = v9;
  if( (v9 & 3) == 0 )
  {
    if( v7 || (_DWORD)OutputBufferLength )
    {
      if( v7 >= (unsigned int)OutputBufferLength )
      {
        v14->AssociatedIrp.MasterIrp = (_IRP *)InputBuffer;
      }
      else
      {
        v14->AssociatedIrp.MasterIrp = (_IRP *)OutputBuffer;
        memmove(OutputBuffer, InputBuffer, v7);
      }
      v11->Flags = 16;
      v11->UserBuffer = OutputBuffer;
      if( OutputBuffer )
        v11->Flags |= 0x40u;
    }
    else
    {
      v14->Flags = 0;
      v14->UserBuffer = 0i64;
    }
    goto LABEL_10;
  }
  if( v12 > 2 )
  {
    if( v12 == 3 )
    {
      v14->UserBuffer = OutputBuffer;
      *(_QWORD *)&CurrentStackLocation[-1].Parameters.EaLength = InputBuffer;
    }
    goto LABEL_10;
  }
  if( InputBuffer )
  {
    v14->AssociatedIrp.MasterIrp = (_IRP *)InputBuffer;
    v14->Flags = 16;
  }
  else
  {
    v14->Flags = 0;
  }
  if( OutputBuffer )
  {
    Mdl = IoAllocateMdl(OutputBuffer, (unsigned int)OutputBufferLength, 0, 0, 0i64);
    v11->MdlAddress = Mdl;
    if( Mdl )
    {
      MmProbeAndLockPages(Mdl, 0, (_LOCK_OPERATION)(v12 != 1));
      goto LABEL_10;
    }
LABEL_21:
    Status = -1073741670;
    goto LABEL_32;
  }
LABEL_10:
  v11 = Irp;
  Irp->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
  Irp->Flags |= 4u;
  Irp->RequestorMode = 0;
  v17 = v27->CurrentStackLocation;
  v17[-1].CompletionRoutine = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *, void *))SmKmGenericCompletion;
  v17[-1].Context = &Object;
  v17[-1].Control = 0;
  v17[-1].Control = 64;
  v17[-1].Control = -64;
  v17[-1].Control = -32;
  if( IofCallDriver((UINT64)DeviceObject, (UINT64)Irp) == 259 )
  {
    ObjectArray = &Object;
    if( FsRtlCancellableWaitForMultipleObjects(1ui64, &ObjectArray, WaitAll, 0i64, 0i64, 0i64) == -1073741749 )
    {
      IoCancelIrp((_KDPC *)Irp, v21, v22, v23);
      KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    }
  }
  Status = Irp->IoStatus.Status;
  Information = Irp->IoStatus.Information;
  *(_DWORD *)RetOutputBufferSize = Information;
  if( Status >= 0 && Information && v7 >= (unsigned int)OutputBufferLength )
  {
    if( Information < (unsigned int)OutputBufferLength )
      v16 = Information;
    memmove(OutputBuffer, InputBuffer, v16);
  }
LABEL_32:
  if( v11 )
  {
    MdlAddress = v11->MdlAddress;
    if( MdlAddress )
    {
      FsRtlpFreeMdlChain(MdlAddress);
      v11->MdlAddress = 0i64;
    }
    IoFreeIrp(v11);
  }
  return Status;
}

Referenced by: