ZwQueryInformationFile

NTSTATUS __stdcall ZwQueryInformationFile(
        VOID *FileHandle,
        IO_STATUS_BLOCK *IoStatusBlock,
        VOID *FileInformation,
        UINT64 Length,
        FILE_INFORMATION_CLASS FileInformationClass){
  NTSTATUS result; 
  _disable();
  __readeflags();
  KiServiceInternal();
  return result;
}

Referenced by:

AslFileMappingCreate
BiLogFileOwnerProcess
CMFGetFileSizeEx
CmpCmdHiveClose
CmpGetFileSize
CmpInitHiveFromFile
CmpOpenHiveFile
DbgkCaptureLiveKernelDump
EmInitSystem
EtwpRealtimeRestoreState
EtwpUpdateFileHeader
IopFileUtilClearAttributes
IopLiveDumpValidateDumpFileHandle
KsepShimDatabaseTime
PfpQueryFileExtentsRequest
PopValidateHiberFileSize
PopZeroHiberFile
RtlFileMapMapView
SmKmStoreFileCreate
SmKmStoreFileWriteHeader