FsRtlTruncateSmallMcb
NTSTATUS __stdcall FsRtlTruncateSmallMcb(INT64 a1, UINT64 *a2, INT64 a3, UINT64 a4){
__int64 v8;
__int64 v10;
__int64 v11;
INT64 v12;
KeExitRetpoline();
v8 = ((__int64)a2 >> 47) + 1;
if( (__int64)a2 >> 47 != -1 && v8 != 1 )
{
*(_BYTE *)a1 = 0;
*(_QWORD *)(a1 + 32) = a4 >> 8;
v12 = a3;
v10 = __ROL8__(a2, a3);
v11 = __ROR8__(a1, a3);
*(_QWORD *)(a1 + 40) ^= a4;
*(_QWORD *)(a1 + 48) ^= a3;
LODWORD(v8) = KiCustomAccessRoutine0(a2);
}
return v8;
}Referenced by:
KiInterruptThunk
__1
__2
__3
__4
__5
__6
__7
__8
__9
__a
__b
__c
__d
__e
__f