FsFilterCtrlInit

NTSTATUS __stdcall FsFilterCtrlInit(
        _FS_FILTER_CTRL *FsFilterCtrl,
        UINT8 Operation,
        _DEVICE_OBJECT *DeviceObject,
        _DEVICE_OBJECT *BaseFsDeviceObject,
        _FILE_OBJECT *FileObject,
        UINT8 CanFail){
  NTSTATUS v6; 
  unsigned __int16 StackSize; 
  _FS_FILTER_CTRL *v9; 
  size_t v10; 
  NTSTATUS result; 
  UINT64 AllocationSize; 

  v6 = 0;
  *((_QWORD *)FsFilterCtrl + 2) = FileObject;
  *FsFilterCtrl = 64;
  *((_BYTE *)FsFilterCtrl + 4) = Operation;
  *((_QWORD *)FsFilterCtrl + 1) = DeviceObject;
  FsFilterCtrl[16] = 0;
  *(_OWORD *)(FsFilterCtrl + 6) = 0i64;
  LODWORD(AllocationSize) = 0;
  *(_OWORD *)(FsFilterCtrl + 10) = 0i64;
  *((_QWORD *)FsFilterCtrl + 7) = 0i64;
  StackSize = DeviceObject->StackSize;
  *((_WORD *)FsFilterCtrl + 36) = StackSize;
  *((_WORD *)FsFilterCtrl + 37) = 0;
  if( StackSize <= 0xFu )
  {
    v9 = FsFilterCtrl + 22;
    *((_QWORD *)FsFilterCtrl + 10) = v9;
    v10 = 480;
    *((_WORD *)FsFilterCtrl + 36) = 15;
LABEL_3:
    memset(v9, 0i64, v10);
    return v6;
  }
  result = FsFilterAllocateCompletionStack(FsFilterCtrl, CanFail, &AllocationSize);
  v6 = result;
  if( result >= 0 )
  {
    v9 = (_FS_FILTER_CTRL *)*((_QWORD *)FsFilterCtrl + 10);
    v10 = AllocationSize;
    goto LABEL_3;
  }
  return result;
}

Referenced by:

FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlQueryOpen
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite