FsRtlSetKernelEaFile

NTSTATUS __stdcall FsRtlSetKernelEaFile(PFILE_OBJECT FileObject, VOID *EaBuffer, UINT64 Length){
  int v3; 
  _IRP *v6; 
  _DEVICE_OBJECT *v7; 
  _IRP *v8; 
  $53AF3F349F2CB9475F75F7184FEA4434 *v9; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  _IO_STACK_LOCATION *v11; 
  NTSTATUS Status; 
  void *v13; 
  void *v14; 
  void *v15; 
  _MDL *MdlAddress; 
  _IRP *Irp; 
  VOID *ObjectArray; 
  __int128 Object; 
  __int64 v21; 
  _DEVICE_OBJECT *DeviceObject; 

  v3 = Length;
  v6 = 0i64;
  Object = 0i64;
  v21 = 0i64;
  KeInitializeEvent((INT64)&Object, 0, 0);
  if( (FileObject->Flags & 0x800) != 0 )
  {
    Status = -1073741808;
  }
  else
  {
    LODWORD(v7) = IoGetRelatedDeviceObject((INT64)FileObject);
    DeviceObject = v7;
    v8 = IoAllocateIrpEx(v7, v7->StackSize, 0);
    v6 = v8;
    Irp = v8;
    if( v8 )
    {
      v9 = &v8->Tail.64;
      CurrentStackLocation = v8->Tail.CurrentStackLocation;
      *(_WORD *)&CurrentStackLocation[-1].MajorFunction = 1032;
      CurrentStackLocation[-1].FileObject = FileObject;
      v6->UserBuffer = EaBuffer;
      LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = v3;
      v6 = Irp;
      Irp->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
      Irp->Flags = 4;
      Irp->RequestorMode = 0;
      v11 = v9->CurrentStackLocation;
      v11[-1].CompletionRoutine = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *, void *))SmKmGenericCompletion;
      v11[-1].Context = &Object;
      v11[-1].Control = 0;
      v11[-1].Control = 64;
      v11[-1].Control = -64;
      v11[-1].Control = -32;
      if( IofCallDriver((UINT64)DeviceObject, (UINT64)Irp) == 259 )
      {
        ObjectArray = &Object;
        if( FsRtlCancellableWaitForMultipleObjects(1ui64, &ObjectArray, WaitAll, 0i64, 0i64, 0i64) == -1073741749 )
        {
          IoCancelIrp((_KDPC *)Irp, v13, v14, v15);
          KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
        }
      }
      Status = Irp->IoStatus.Status;
    }
    else
    {
      Status = -1073741670;
    }
  }
  if( v6 )
  {
    MdlAddress = v6->MdlAddress;
    if( MdlAddress )
    {
      FsRtlpFreeMdlChain(MdlAddress);
      v6->MdlAddress = 0i64;
    }
    IoFreeIrp(v6);
  }
  return Status;
}

Referenced by: