FsRtlGetMarkHandleInfo

NTSTATUS __stdcall FsRtlGetMarkHandleInfo(_IRP *a1){
  _IO_STACK_LOCATION *CurrentStackLocation; 
  unsigned int Options; 
  _IRP *MasterIrp; 
  __int128 *p_Type; 
  __int128 v7; 
  __int64 v8; 

  v8 = 0i64;
  CurrentStackLocation = a1->Tail.CurrentStackLocation;
  v7 = 0i64;
  Options = CurrentStackLocation->Parameters.Options;
  if( !IoIs32bitProcess(a1) )
  {
    if( Options >= 0x18 )
    {
      p_Type = (__int128 *)&a1->AssociatedIrp.MasterIrp->Type;
      return *((_DWORD *)p_Type + 4);
    }
    return 0;
  }
  if( Options < 0xC )
    return 0;
  MasterIrp = a1->AssociatedIrp.MasterIrp;
  LODWORD(v8) = MasterIrp->MdlAddress;
  LODWORD(v7) = *(_DWORD *)&MasterIrp->Type;
  *((_QWORD *)&v7 + 1) = *(int *)&MasterIrp->AllocationProcessorNumber;
  p_Type = &v7;
  return *((_DWORD *)p_Type + 4);
}

Referenced by: