FsFilterCtrlInit
NTSTATUS __stdcall FsFilterCtrlInit(
_FS_FILTER_CTRL *FsFilterCtrl,
UINT8 Operation,
_DEVICE_OBJECT *DeviceObject,
_DEVICE_OBJECT *BaseFsDeviceObject,
_FILE_OBJECT *FileObject,
UINT8 CanFail){
NTSTATUS v6;
unsigned __int16 StackSize;
_FS_FILTER_CTRL *v9;
size_t v10;
NTSTATUS result;
UINT64 AllocationSize;
v6 = 0;
*((_QWORD *)FsFilterCtrl + 2) = FileObject;
*FsFilterCtrl = 64;
*((_BYTE *)FsFilterCtrl + 4) = Operation;
*((_QWORD *)FsFilterCtrl + 1) = DeviceObject;
FsFilterCtrl[16] = 0;
*(_OWORD *)(FsFilterCtrl + 6) = 0i64;
LODWORD(AllocationSize) = 0;
*(_OWORD *)(FsFilterCtrl + 10) = 0i64;
*((_QWORD *)FsFilterCtrl + 7) = 0i64;
StackSize = DeviceObject->StackSize;
*((_WORD *)FsFilterCtrl + 36) = StackSize;
*((_WORD *)FsFilterCtrl + 37) = 0;
if( StackSize <= 0xFu )
{
v9 = FsFilterCtrl + 22;
*((_QWORD *)FsFilterCtrl + 10) = v9;
v10 = 480;
*((_WORD *)FsFilterCtrl + 36) = 15;
LABEL_3:
memset(v9, 0i64, v10);
return v6;
}
result = FsFilterAllocateCompletionStack(FsFilterCtrl, CanFail, &AllocationSize);
v6 = result;
if( result >= 0 )
{
v9 = (_FS_FILTER_CTRL *)*((_QWORD *)FsFilterCtrl + 10);
v10 = AllocationSize;
goto LABEL_3;
}
return result;
}Referenced by:
FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlQueryOpen
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite