IopGetVolumeId

NTSTATUS __stdcall IopGetVolumeId(PVOID FileObject, _LINK_TRACKING_INFORMATION *ObjectId, UINT64 Length){
  _DEVICE_OBJECT *v5; 
  UINT64 v6; 
  PIRP *v7; 
  UINT64 v8; 
  PIRP v9; 
  NTSTATUS result; 
  __int128 v11; 
  __int128 Object; 
  __int64 v13; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 v15[4]; 

  v13 = 0i64;
  IoStatusBlock = 0i64;
  Object = 0i64;
  memset(v15, 0i64, sizeof(v15));
  KeInitializeEvent((INT64)&Object, 0, 0);
  LODWORD(v5) = IoGetRelatedDeviceObject((INT64)FileObject);
  v6 = (UINT64)v5;
  v7 = IoBuildDeviceIoControlRequest(0, v5, 0i64, 0, 0i64, 0, 0, (PKEVENT)&Object, &IoStatusBlock);
  v8 = (UINT64)v7;
  if( !v7 )
    return -1073741670;
  *((_DWORD *)v7 + 4) |= 4u;
  v7[24] = (PIRP)FileObject;
  v7[14] = (PIRP)v15;
  v7[3] = (PIRP)v15;
  v9 = v7[23];
  v9[-1].Tail.CurrentStackLocation = (_IO_STACK_LOCATION *)FileObject;
  LOBYTE(v9[-1].Tail.DriverContext[2]) = 10;
  LODWORD(v9[-1].Tail.DriverContext[3]) = 64;
  LODWORD(v9[-1].Tail.Thread) = 8;
  ObfReferenceObject(FileObject);
  result = IofCallDriver(v6, v8);
  if( result == 259 )
  {
    KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    result = IoStatusBlock.Status;
  }
  if( result >= 0 )
  {
    v11 = v15[0];
    ObjectId->Type = NtfsLinkTrackingInformation;
    *(_OWORD *)ObjectId->VolumeId = v11;
  }
  return result;
}

Referenced by: