FsRtlQueryKernelEaFile

NTSTATUS __stdcall FsRtlQueryKernelEaFile(
        _FILE_OBJECT *FileObject,
        VOID *ReturnedEaData,
        UINT64 Length,
        UINT8 ReturnSingleEntry,
        VOID *EaList,
        UINT64 EaListLength,
        UINT64 *EaIndex,
        UINT8 RestartScan,
        UINT64 *LengthReturned){
  int v10; 
  _IRP *v13; 
  _DEVICE_OBJECT *v14; 
  _IRP *v15; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  _IO_STACK_LOCATION *v17; 
  NTSTATUS Status; 
  void *v19; 
  void *v20; 
  void *v21; 
  _MDL *MdlAddress; 
  _IRP *Irp; 
  _DEVICE_OBJECT *DeviceObject; 
  VOID *ObjectArray; 
  __int128 Object; 
  __int64 v28; 

  v10 = Length;
  v13 = 0i64;
  Object = 0i64;
  v28 = 0i64;
  KeInitializeEvent((INT64)&Object, 0, 0);
  if( (FileObject->Flags & 0x800) != 0 )
  {
    Status = -1073741808;
  }
  else
  {
    LODWORD(v14) = IoGetRelatedDeviceObject((INT64)FileObject);
    DeviceObject = v14;
    v15 = IoAllocateIrpEx(v14, v14->StackSize, 0);
    v13 = v15;
    Irp = v15;
    if( v15 )
    {
      CurrentStackLocation = v15->Tail.CurrentStackLocation;
      CurrentStackLocation[-1].MajorFunction = 7;
      CurrentStackLocation[-1].FileObject = FileObject;
      v15->UserBuffer = ReturnedEaData;
      LODWORD(CurrentStackLocation[-1].Parameters.SecurityContext) = v10;
      *(_QWORD *)&CurrentStackLocation[-1].Parameters.Options = EaList;
      *(_DWORD *)&CurrentStackLocation[-1].Parameters.FileAttributes = EaListLength;
      if( EaIndex )
      {
        CurrentStackLocation[-1].Parameters.EaLength = *(_DWORD *)EaIndex;
        CurrentStackLocation[-1].Flags |= 4u;
      }
      else
      {
        CurrentStackLocation[-1].Parameters.EaLength = 0;
      }
      if( RestartScan )
        CurrentStackLocation[-1].Flags |= 1u;
      if( ReturnSingleEntry )
        CurrentStackLocation[-1].Flags |= 2u;
      v13 = v15;
      v15->Tail.Thread = (_ETHREAD *)KeGetCurrentThread();
      v15->Flags = 4;
      v15->RequestorMode = 0;
      v17 = v15->Tail.CurrentStackLocation;
      v17[-1].CompletionRoutine = (int(__fastcall *)(_DEVICE_OBJECT *, _IRP *, void *))SmKmGenericCompletion;
      v17[-1].Context = &Object;
      v17[-1].Control = 0;
      v17[-1].Control = 64;
      v17[-1].Control = -64;
      v17[-1].Control = -32;
      if( IofCallDriver((UINT64)DeviceObject, (UINT64)Irp) == 259 )
      {
        ObjectArray = &Object;
        if( FsRtlCancellableWaitForMultipleObjects(1ui64, &ObjectArray, WaitAll, 0i64, 0i64, 0i64) == -1073741749 )
        {
          IoCancelIrp((_KDPC *)Irp, v19, v20, v21);
          KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
        }
      }
      Status = Irp->IoStatus.Status;
      *(_DWORD *)LengthReturned = Irp->IoStatus.Information;
    }
    else
    {
      Status = -1073741670;
    }
  }
  if( v13 )
  {
    MdlAddress = v13->MdlAddress;
    if( MdlAddress )
    {
      FsRtlpFreeMdlChain(MdlAddress);
      v13->MdlAddress = 0i64;
    }
    IoFreeIrp(v13);
  }
  return Status;
}

Referenced by: