RawQueryFileSystemInformation

NTSTATUS __stdcall RawQueryFileSystemInformation(_IRP *Irp, _IO_STACK_LOCATION *IrpSp, _VCB *Vcb){
  size_t SecurityContext; 
  int Status; 
  _IRP *MasterIrp; 
  _DEVICE_OBJECT *v8; 
  VOID *v9; 
  UINT64 v10; 
  size_t v11; 
  VOID **PoolWithTag; 
  __int64 v13; 
  _IRP *v14; 
  size_t v15; 
  int v16; 
  _KEVENT *Event; 
  UINT8 IoStatusBlock; 
  UINT8 ReturnAddress; 
  _IO_STATUS_BLOCK *v21; 
  __int128 Object; 
  __int64 v23; 
  _IO_STATUS_BLOCK v24; 
  _LARGE_INTEGER Timeout[2]; 
  UINT64 NumberOfBytes; 
  VOID *retaddr; 

  v23 = 0i64;
  NumberOfBytes = 0i64;
  SecurityContext = (size_t)IrpSp->Parameters.SecurityContext;
  Object = 0i64;
  v24 = 0i64;
  *(_OWORD *)&Timeout[0].anonymous_0.LowPart = 0i64;
  if( SecurityContext < 9 )
    return -1073741789;
  MasterIrp = Irp->AssociatedIrp.MasterIrp;
  memset(MasterIrp, 0i64, SecurityContext);
  Status = RawPerformDevIoCtrl(
             v8,
             *((VOID **)Vcb + 22),
             v9,
             v10,
             Timeout,
             (UINT64)Event,
             IoStatusBlock,
             ReturnAddress,
             v21);
  if( Status >= 0 )
  {
    v11 = HIDWORD(NumberOfBytes);
    if( HIDWORD(NumberOfBytes) >= 0x18 )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, HIDWORD(NumberOfBytes), 1649885522i64);
      v13 = (__int64)PoolWithTag;
      if( PoolWithTag )
      {
        memset(PoolWithTag, 0i64, v11);
        KeInitializeEvent((INT64)&Object, 0, 0);
        v14 = IopBuildSynchronousFsdRequest(
                3ui64,
                *((_DEVICE_OBJECT **)Vcb + 22),
                (VOID *)v13,
                v11,
                0i64,
                (_KEVENT *)&Object,
                &v24,
                retaddr);
        if( v14 )
        {
          v14->Tail.CurrentStackLocation[-1].Flags |= 2u;
          Status = IofCallDriver(*((_QWORD *)Vcb + 22), (UINT64)v14);
          if( Status == 259 )
          {
            KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
            Status = v24.Status;
          }
          if( Status >= 0 )
          {
            if( *(_DWORD *)(v13 + 16) == 1397904198
              && (v15 = *(unsigned __int16 *)(v13 + 20), v15 <= v11)
              && (unsigned __int16)v15 >= 0x18u
              && (unsigned __int16)RawComputeFileSystemInformationChecksum(v13) == *(_WORD *)(v13 + 22) )
            {
              if( *(_BYTE *)(v13 + 3) == 82
                && *(_BYTE *)(v13 + 4) == 101
                && *(_BYTE *)(v13 + 5) == 70
                && *(_BYTE *)(v13 + 6) == 83 )
              {
                v16 = Status;
                if( !*(_BYTE *)(v13 + 7) )
                  v16 = -1073741637;
                Status = v16;
              }
              *(_QWORD *)&MasterIrp->Type = *(_QWORD *)(v13 + 3);
              Irp->IoStatus.Information = 9i64;
            }
            else
            {
              Status = -1073741637;
            }
          }
        }
        else
        {
          Status = -1073741670;
        }
        ExFreePoolWithTag((PVOID)v13, 0);
      }
      else
      {
        return -1073741670;
      }
    }
    else
    {
      return -1073741637;
    }
  }
  return Status;
}

Referenced by: