FsRtlGetFileSize

NTSTATUS __stdcall FsRtlGetFileSize(_FILE_OBJECT *FileObject, _LARGE_INTEGER *FileSize){
  _DEVICE_OBJECT *v4; 
  __int64 v5; 
  _DEVICE_OBJECT *v6; 
  _FAST_IO_DISPATCH *FastIoDispatch; 
  unsigned __int8(__fastcall *FastIoQueryStandardInfo)(_FILE_OBJECT *, unsigned __int8, _FILE_STANDARD_INFORMATION *, _IO_STATUS_BLOCK *, _DEVICE_OBJECT *); 
  NTSTATUS result; 
  _IRP *Irp; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  char v12; 
  char v13; 
  NTSTATUS v14; 
  NTSTATUS v15; 
  __int128 v16; 
  __int128 Object; 
  __int64 v18; 
  __int128 v19; 
  __int64 v20; 

  v16 = 0i64;
  v20 = 0i64;
  v19 = 0i64;
  LODWORD(v4) = IoGetRelatedDeviceObject((INT64)FileObject);
  v6 = v4;
  FastIoDispatch = v4->DriverObject->FastIoDispatch;
  if( !FastIoDispatch
    || (FastIoQueryStandardInfo = FastIoDispatch->FastIoQueryStandardInfo) == 0i64
    || (LOBYTE(v5) = 1,
        !FastIoQueryStandardInfo(FileObject, v5, (_FILE_STANDARD_INFORMATION *)&v19, (_IO_STATUS_BLOCK *)&v16, v6)) )
  {
    v18 = 0i64;
    Object = 0i64;
    KeInitializeEvent((INT64)&Object, 0, 0);
    Irp = IoAllocateIrpEx(v6, v6->StackSize, 0);
    if( !Irp )
      return -1073741670;
    IoSetThreadHardErrorMode(0);
    CurrentStackLocation = Irp->Tail.CurrentStackLocation;
    v13 = v12;
    Irp->Flags = 66;
    Irp->UserIosb = (_IO_STATUS_BLOCK *)&v16;
    Irp->UserEvent = (_KEVENT *)&Object;
    Irp->RequestorMode = 0;
    Irp->Tail.OriginalFileObject = FileObject;
    Irp->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
    Irp->AssociatedIrp.MasterIrp = (_IRP *)&v19;
    CurrentStackLocation[-1].MajorFunction = 5;
    CurrentStackLocation[-1].FileObject = FileObject;
    CurrentStackLocation[-1].DeviceObject = v6;
    LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = 24;
    CurrentStackLocation[-1].Parameters.Options = 5;
    v14 = IofCallDriver((UINT64)v6, (UINT64)Irp);
    if( v14 == 259 )
      KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    v15 = v16;
    if( v14 < 0 )
      v15 = v14;
    LODWORD(v16) = v15;
    LOBYTE(v15) = v13;
    IoSetThreadHardErrorMode(v15);
  }
  result = v16;
  if( (int)v16 >= 0 )
  {
    if( BYTE5(v20) )
      return -1073741638;
    else
      *FileSize = *(_LARGE_INTEGER *)((char *)&v19 + 8);
  }
  return result;
}

Referenced by: