NTSTATUS __stdcall FsRtlGetFileExtents(
_FILE_OBJECT *FileObject,
UINT64 ByteOffset,
UINT64 NumberOfBytes,
PHYSICAL_EXTENTS_DESCRIPTOR *ExtentRanges,
PHYSICAL_EXTENTS_DESCRIPTOR *ExtentRangesa){
_DEVICE_OBJECT *v8;
_DEVICE_OBJECT *v9;
_IRP *Irp;
_IRP *v11;
_IO_STACK_LOCATION *CurrentStackLocation;
NTSTATUS v14;
__int128 v15;
__int64 v16[3];
v15 = 0i64;
LODWORD(v8) = IoGetRelatedDeviceObject((INT64)FileObject);
v9 = v8;
Irp = IoAllocateIrpEx(v8, v8->StackSize, 0);
v11 = Irp;
if( !Irp )
return -1073741670;
v16[2] = 0i64;
v16[0] = NumberOfBytes;
v16[1] = (__int64)ExtentRanges;
Irp->RequestorMode = 0;
Irp->UserIosb = (_IO_STATUS_BLOCK *)&v15;
Irp->UserEvent = 0i64;
Irp->UserBuffer = ExtentRangesa;
CurrentStackLocation = Irp->Tail.CurrentStackLocation;
Irp->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
*(_WORD *)&CurrentStackLocation[-1].MajorFunction = 1037;
CurrentStackLocation[-1].FileObject = FileObject;
*(_DWORD *)&CurrentStackLocation[-1].Parameters.FileAttributes = 590747;
CurrentStackLocation[-1].Parameters.Options = 24;
LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = 16 * ExtentRangesa->NumberOfRuns + 8;
*(_QWORD *)&CurrentStackLocation[-1].Parameters.EaLength = v16;
v14 = IoSynchronousCallDriver(v9, Irp);
IoFreeIrp(v11);
return v14;
}