FsRtlQueryCachedVdl

NTSTATUS __stdcall FsRtlQueryCachedVdl(_FILE_OBJECT *FileObject, INT64 *Vdl){
  _DEVICE_OBJECT *v4; 
  UINT64 v5; 
  PIRP *v6; 
  UINT64 v7; 
  PIRP v8; 
  NTSTATUS Status; 
  int *v10; 
  __int64 v11; 
  __int128 Object; 
  __int64 v14; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __m128i si128; 
  int v17; 

  v14 = 0i64;
  Object = 0i64;
  IoStatusBlock = 0i64;
  KeInitializeEvent((INT64)&Object, 0, 0);
  LODWORD(v4) = IoGetRelatedDeviceObject((INT64)FileObject);
  v5 = (UINT64)v4;
  v6 = IoBuildDeviceIoControlRequest(0x90284u, v4, 0i64, 0, 0i64, 0, 0, (PKEVENT)&Object, &IoStatusBlock);
  v7 = (UINT64)v6;
  if( !v6 )
    return -1073741670;
  si128 = _mm_load_si128((const __m128i *)&_xmm);
  v17 = 1;
  v6[3] = (PIRP)&si128;
  v8 = v6[23];
  v8[-1].Tail.CurrentStackLocation = (_IO_STACK_LOCATION *)FileObject;
  LOBYTE(v8[-1].Tail.DriverContext[2]) = 13;
  LODWORD(v8[-1].Tail.Thread) = 24;
  LODWORD(v8[-1].Tail.DriverContext[3]) = 64;
  Status = IofCallDriver(v5, v7);
  if( Status == 259 )
  {
    KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    Status = IoStatusBlock.Status;
  }
  if( (Status & 0xC0000000) != -1073741824 )
  {
    *Vdl = 0i64;
    if( si128.m128i_i32[2] )
    {
      v10 = &v17;
      v11 = si128.m128i_u32[2];
      do
      {
        if( (v10[4] & 1) != 0 )
          *Vdl = *(_QWORD *)v10 + *((_QWORD *)v10 + 1);
        v10 += 6;
        --v11;
      }
      while( v11 );
    }
  }
  return Status;
}

Referenced by: