NtQueryVolumeInformationFile

NTSTATUS __fastcall NtQueryVolumeInformationFile(UINT64 a1, UINT64 a2, UINT64 a3, UINT64 a4, UINT64 FsInformationClass){
  UINT64 v5; 
  NTSTATUS v8; 
  _ETHREAD *CurrentThread; 
  INT8 PreviousMode; 
  int v11; 
  unsigned int v12; 
  UINT64 v13; 
  _EWOW64PROCESS *WoW64Process; 
  bool v15; 
  INT64 v16; 
  unsigned __int16 Machine; 
  NTSTATUS result; 
  _ADAPTER_OBJECT *v19; 
  _DWORD *p_Flags; 
  __int64 Flags; 
  UINT8 MountFlag; 
  _DEVICE_OBJECT *v23; 
  unsigned int Characteristics; 
  unsigned int v25; 
  _ETHREAD *v26; 
  _FILE_OBJECT *v27; 
  _BYTE *v28; 
  NTSTATUS v29; 
  PDEVICE_OBJECT v30; 
  _IRP *v31; 
  _IRP *v32; 
  _IO_STATUS_BLOCK *p_LocalIoStatus; 
  _KEVENT *v34; 
  __int64 v35; 
  VOID *PoolWithQuota; 
  __int64 v37; 
  UINT8 v38; 
  CHAR v39; 
  void *Pool; 
  _FILE_FS_DRIVER_PATH_INFORMATION *v41; 
  NTSTATUS v42; 
  UINT8 SynchronousIo; 
  CHAR v44; 
  bool v45; 
  NTSTATUS v46; 
  _FILE_OBJECT *pFileObject; 
  PVOID KernelEvent; 
  PDEVICE_OBJECT DeviceObject; 
  PIRP Irp; 
  _ETHREAD *v51; 
  _FILE_FS_DRIVER_PATH_INFORMATION *v52; 
  _IO_STATUS_BLOCK LocalIoStatus; 
  VOID *retaddr; 

  v5 = (unsigned int)a4;
  v8 = 0;
  pFileObject = 0i64;
  KernelEvent = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v51 = CurrentThread;
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  v44 = PreviousMode;
  if( PreviousMode )
  {
    v11 = FsInformationClass;
    if( (unsigned int)FsInformationClass >= 0xF )
      return -1073741821;
    v12 = *((unsigned __int8 *)IopQueryFsOperationLength + (int)FsInformationClass);
    if( !(_BYTE)v12 )
      return -1073741821;
    if( (unsigned int)a4 < v12 )
      return -1073741820;
    v13 = a2;
    if( a2 >= 0x7FFFFFFF0000i64 )
      v13 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v13 = *(_DWORD *)v13;
    WoW64Process = CurrentThread->Tcb.ApcState.Process->WoW64Process;
    v15 = 0;
    if( WoW64Process )
    {
      Machine = WoW64Process->Machine;
      if( Machine == 332 || Machine == 452 )
        v15 = 1;
    }
    v45 = v15;
    if( v15 )
      v16 = 4i64;
    else
      v16 = *((unsigned __int8 *)IopQuerySetFsAlignmentRequirement + (int)FsInformationClass);
    ProbeForWrite(a3, (unsigned int)a4, v16);
  }
  else
  {
    v11 = FsInformationClass;
  }
  result = IopReferenceFileObject(
             (VOID *)a1,
             (unsigned int)IopQueryFsOperationAccess[v11],
             PreviousMode,
             &pFileObject,
             0i64);
  v46 = result;
  if( result >= 0 )
  {
    v19 = (_ADAPTER_OBJECT *)pFileObject;
    p_Flags = &pFileObject->Flags;
    Irp = (PIRP)&pFileObject->Flags;
    Flags = pFileObject->Flags;
    if( (pFileObject->Flags & 0x800) != 0 )
    {
      if( v11 != 4 )
      {
        HalPutDmaAdapter((PADAPTER_OBJECT)pFileObject);
        return -1073741808;
      }
    }
    else if( v11 != 4 )
    {
      goto LABEL_30;
    }
    if( (pFileObject->Flags & 0x800) != 0 || pFileObject->DeviceObject->DeviceType != 20 )
    {
      MountFlag = 0;
      v23 = pFileObject->DeviceObject;
      if( v23->Vpb )
        MountFlag = IopGetMountFlag(pFileObject->DeviceObject);
      if( (unsigned int)v5 < 8 )
      {
        v8 = -1073741820;
      }
      else
      {
        *(_DWORD *)a3 = v23->DeviceType;
        Characteristics = v23->Characteristics;
        *(_DWORD *)(a3 + 4) = Characteristics;
        if( MountFlag )
          *(_DWORD *)(a3 + 4) = Characteristics | 0x20;
        *(_DWORD *)a2 = 0;
        *(_QWORD *)(a2 + 8) = 8i64;
        v46 = 0;
      }
      HalPutDmaAdapter(v19);
      return v8;
    }
LABEL_30:
    if( (Flags & 2) != 0 )
    {
      v25 = (unsigned int)Flags >> 2;
      LOBYTE(v25) = v25 & 1;
      LODWORD(DeviceObject) = v25;
      v26 = (_ETHREAD *)KeGetCurrentThread();
      --v26->Tcb.KernelApcDisable;
      v27 = pFileObject;
      v28 = KeAbPreAcquire(pFileObject->gap80, 0i64, 0i64);
      SynchronousIo = 0;
      if( _InterlockedExchange((volatile __int32 *)&v27->Busy, 1) )
      {
        v19 = (_ADAPTER_OBJECT *)pFileObject;
        v29 = IopWaitAndAcquireFileObjectLock(pFileObject, v44, (UINT8)DeviceObject, v28, (INT64)&SynchronousIo);
      }
      else
      {
        if( v28 )
          v28[26] |= 1u;
        v19 = (_ADAPTER_OBJECT *)pFileObject;
        ObfReferenceObject(pFileObject);
        v29 = 0;
      }
      if( SynchronousIo )
        goto LABEL_63;
      SynchronousIo = 1;
      p_Flags = &Irp->Type;
    }
    else
    {
      SynchronousIo = 0;
    }
    if( v11 != 9 )
    {
      IopResetEvent((_FILE_OBJECT *)v19);
      LODWORD(v30) = IoGetRelatedDeviceObject((INT64)v19);
      DeviceObject = v30;
      if( (*p_Flags & 2) == 0 )
      {
        Pool = IopVerifierExAllocatePool();
        KernelEvent = Pool;
        if( !Pool )
        {
          HalPutDmaAdapter(v19);
          return -1073741670;
        }
        KeInitializeEvent((INT64)Pool, 1, 0);
        v30 = DeviceObject;
      }
      v31 = IopAllocateIrpExReturn(v30, v30->StackSize, 0, retaddr);
      Irp = v31;
      if( v31 )
      {
        v32 = v31;
        v31->Tail.OriginalFileObject = (_FILE_OBJECT *)v19;
        v31->Tail.Thread = v51;
        v31->RequestorMode = v44;
        LocalIoStatus = 0i64;
        if( SynchronousIo )
        {
          p_LocalIoStatus = (_IO_STATUS_BLOCK *)a2;
          v34 = 0i64;
        }
        else
        {
          v31->Flags = 4;
          p_LocalIoStatus = &LocalIoStatus;
          v34 = (_KEVENT *)KernelEvent;
        }
        v32->UserEvent = v34;
        v32->UserIosb = p_LocalIoStatus;
        v32->Overlay.UserApcRoutine = 0i64;
        v35 = (__int64)&v32->Tail.CurrentStackLocation[-1];
        v51 = (_ETHREAD *)v35;
        *(_BYTE *)v35 = 10;
        *(_QWORD *)(v35 + 48) = v19;
        v32->UserBuffer = (void *)a3;
        v32->AssociatedIrp.MasterIrp = 0i64;
        v32->MdlAddress = 0i64;
        PoolWithQuota = IopVerifierExAllocatePoolWithQuota((__int64)v34, v5);
        v32->AssociatedIrp.MasterIrp = (_IRP *)PoolWithQuota;
        if( !*(&stru_140CF2E80 + 1657) )
          memset(PoolWithQuota, 0i64, v5);
        v32->Flags |= 0x870u;
        v37 = (__int64)v51;
        *(_DWORD *)&v51->Tcb.gap0[8] = v5;
        *(_DWORD *)(v37 + 16) = v11;
        v38 = SynchronousIo;
        v39 = v44;
        result = IopSynchronousServiceTail(
                   DeviceObject,
                   v32,
                   (_FILE_OBJECT *)v19,
                   1u,
                   v44,
                   SynchronousIo,
                   OtherTransfer);
        if( !v38 )
          return IopSynchronousApiServiceTail(
                   (unsigned int)result,
                   (_KEVENT *)KernelEvent,
                   v32,
                   v39,
                   &LocalIoStatus,
                   (_IO_STATUS_BLOCK *)a2);
        return result;
      }
      if( (*p_Flags & 2) == 0 )
        ExFreePoolWithTag(KernelEvent, 0);
      IopAllocateIrpCleanup(v19, 0i64);
      return -1073741670;
    }
    v52 = 0i64;
    v41 = (_FILE_FS_DRIVER_PATH_INFORMATION *)IopVerifierExAllocatePoolWithQuota(Flags, v5);
    v52 = v41;
    memmove(v41, (const VOID *)a3, v5);
    IopGetDriverPathInformation((_FILE_OBJECT *)v19, v41, (unsigned int)v5);
    v29 = v42;
    v46 = v42;
    if( v42 < 0 )
      RtlRaiseStatus(v42);
    *(_BYTE *)a3 = v41->DriverInPath;
    *(_DWORD *)a2 = 0;
    *(_QWORD *)(a2 + 8) = 12i64;
    if( v41 )
      ExFreePoolWithTag(v41, 0);
    if( (v19->AdapterObject.ScatterTranslationEnd.Offset & 2) != 0 )
      IopReleaseFileObjectLock(v19);
LABEL_63:
    HalPutDmaAdapter(v19);
    return v29;
  }
  return result;
}

Referenced by: