IoQueryInformationByName

NTSTATUS __fastcall IoQueryInformationByName(INT64 a1, UINT64 a2, INT8 *a3, UINT64 a4, UINT64 a5, INT16 a6, INT16 *Src){
  UINT64 v7; 
  unsigned int FileInformationLength; 
  char v11; 
  CHAR v12; 
  char PreviousMode; 
  _FILE_INFORMATION_CLASS v14; 
  NTSTATUS result; 
  __int64 v16; 
  __int64 SiloContext; 
  void *v18; 
  unsigned __int64 v19; 
  _ETHREAD *CurrentThread; 
  int FinalStatus; 
  _ECP_LIST *v22; 
  void *FileInformation; 
  UINT64 Length; 
  UINT64 Lengtha; 
  INT64 v26; 
  CHAR AccessMode; 
  _OPEN_PACKET ParseContext; 
  PVOID Handle; 
  char v31[272]; 

  v7 = (unsigned int)a4;
  memset(v31, 0i64, sizeof(v31));
  FileInformationLength = 0;
  v11 = 0;
  v12 = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( (a6 & 0x100) == 0 )
    v12 = PreviousMode;
  AccessMode = v12;
  v14 = (int)a5;
  LODWORD(v26) = a5;
  LODWORD(Length) = v7;
  result = IopValidateQueryInformationParameters(v12, (INT64)KeGetCurrentThread(), a2, (UINT64)a3, Length, v26);
  if( result >= 0 )
  {
    if( (_DWORD)a5 == 75 && !AccessMode )
    {
      v14 = FileCaseSensitiveInformation;
      v11 = 1;
    }
    if( ((v14 - 68) & 0xFFFFFFFC) != 0 || v14 == FileMemoryPartitionInformation )
      return -1073741811;
    memset(&ParseContext, 0i64, sizeof(ParseContext));
    *(_DWORD *)&ParseContext.Type = 14155784;
    ParseContext.ShareAccess = 7;
    ParseContext.Disposition = 1;
    ParseContext.CreateOptions = 2113536;
    ParseContext.QueryOnly = 1;
    ParseContext.FilterQuery = 1;
    ParseContext.LocalFileObject = (_DUMMY_FILE_OBJECT *)v31;
    ParseContext.OriginalAttributes = (_OBJECT_ATTRIBUTES *)a1;
    ParseContext.InternalFlags = 32;
    ParseContext.FileInformationClass = v14;
    ParseContext.FileInformationLength = v7;
    memset(&ParseContext.DriverCreateContext, 0, 32);
    ParseContext.DriverCreateContext.Size = 40;
    SiloContext = 1i64;
    ParseContext.DriverCreateContext.SiloContext = (_EJOB *)1;
    if( v11 )
      ParseContext.Options |= 1u;
    if( Src )
    {
      v18 = (void *)*((_QWORD *)Src + 1);
      if( v18 )
      {
        result = FsRtlpPrepareExtraCreateParametersForCreate(v18);
        if( result < 0 )
          return result;
      }
      v19 = *Src;
      if( v19 > 0x28 )
        LODWORD(v19) = 40;
      memmove(&ParseContext.DriverCreateContext, Src, v19);
      SiloContext = (__int64)ParseContext.DriverCreateContext.SiloContext;
    }
    if( SiloContext == 1 )
      ParseContext.DriverCreateContext.SiloContext = PsGetCurrentSilo();
    if( (unsigned __int64)a3 <= 0x7FFFFFFEFFFFi64 )
      ParseContext.FileInformation = IopVerifierExAllocatePoolWithQuota_3(v16, v7);
    else
      ParseContext.FileInformation = a3;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    ++CurrentThread->Tcb.OtherOperationCount;
    __incgsdword(0x2EE4u);
    LODWORD(Lengtha) = 128;
    FinalStatus = ObOpenObjectByNameEx(
                    (_OBJECT_ATTRIBUTES *)a1,
                    (_OBJECT_TYPE *)IoFileObjectType,
                    AccessMode,
                    0i64,
                    Lengtha,
                    &ParseContext,
                    ParseContext.DriverCreateContext.SiloContext,
                    &Handle);
    IopCleanupExtraCreateParameters(&ParseContext, v22);
    if( ParseContext.ParseCheck == -1096154543 )
      FinalStatus = ParseContext.FinalStatus;
    FileInformation = ParseContext.FileInformation;
    if( a3 != ParseContext.FileInformation )
    {
      if( FinalStatus >= 0 )
        memmove(a3, ParseContext.FileInformation, ParseContext.FileInformationLength);
      ExFreePoolWithTag(FileInformation, 0);
    }
    *(_DWORD *)a2 = FinalStatus;
    if( FinalStatus >= 0 )
      FileInformationLength = ParseContext.FileInformationLength;
    *(_QWORD *)(a2 + 8) = FileInformationLength;
    return FinalStatus;
  }
  return result;
}

Referenced by: