IopQueryDockRemovalInterface

__int64 __fastcall IopQueryDockRemovalInterface(_DEVICE_OBJECT *DeviceObject, _QWORD *a2){
  VOID **PoolWithTag; 
  VOID **v5; 
  NTSTATUS v7; 
  _IO_STACK_LOCATION TopStackLocation; 
  GUID v9; 

  v9 = GUID_DOCK_INTERFACE;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x30ui64, 538996816i64);
  v5 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  *(_OWORD *)PoolWithTag = 0i64;
  *((_OWORD *)PoolWithTag + 1) = 0i64;
  *((_OWORD *)PoolWithTag + 2) = 0i64;
  *(_WORD *)PoolWithTag = 48;
  memset(&TopStackLocation, 0i64, sizeof(TopStackLocation));
  *(_WORD *)&TopStackLocation.MajorFunction = 2075;
  TopStackLocation.Parameters.SecurityContext = (_IO_SECURITY_CONTEXT *)&v9;
  TopStackLocation.Parameters.Options = 48;
  *(_QWORD *)&TopStackLocation.Parameters.FileAttributes = v5;
  *(_QWORD *)&TopStackLocation.Parameters.EaLength = 0i64;
  v7 = IopSynchronousCall(DeviceObject, &TopStackLocation, 3221225659i64, 0i64, 0i64);
  if( v7 < 0 )
    ExFreePoolWithTag(v5, 0);
  else
    *a2 = v5;
  return(unsigned int)v7;
}

Referenced by: