FsRtlKernelFsControlFile

NTSTATUS __stdcall FsRtlKernelFsControlFile(
        FILE_OBJECT *FileObject,
        UINT64 FsControlCode,
        PVOID InputBuffer,
        UINT64 InputBufferLength,
        PVOID OutputBuffer,
        UINT64 OutputBufferLength,
        UINT64 *RetOutputBufferSize){
  UINT64 v7; 
  int v9; 
  _IRP *v11; 
  unsigned int v12; 
  _IRP *v13; 
  __int64 v14; 
  unsigned int v15; 
  __int64 v16; 
  NTSTATUS v17; 
  unsigned int v18; 
  _MDL *Mdl; 
  void *v20; 
  void *v21; 
  void *v22; 
  struct _MDL *v23; 
  PIRP Irp; 
  __int64 *v26; 
  _DEVICE_OBJECT *DeviceObject; 
  PVOID ObjectArray; 
  _KEVENT Object; 
  v7 = (unsigned int)InputBufferLength;
  v9 = FsControlCode;
  v11 = 0i64;
  memset(&Object, 0, sizeof(Object));
  KeInitializeEvent(&Object, NotificationEvent, 0);
  v12 = v9 & 3;
  if( (FileObject->Flags & 0x800) != 0 )
  {
    v17 = -1073741808;
    goto LABEL_32;
  }
  DeviceObject = IoGetRelatedDeviceObject(FileObject);
  v13 = IoAllocateIrpEx(DeviceObject, *((_BYTE *)DeviceObject + 76), 0);
  v11 = v13;
  Irp = v13;
  if( !v13 )
    goto LABEL_21;
  v26 = (__int64 *)((char *)v13 + 184);
  v14 = *((_QWORD *)v13 + 23);
  *(_WORD *)(v14 - 72) = 1037;
  *(_QWORD *)(v14 - 24) = FileObject;
  v15 = OutputBufferLength;
  *(_DWORD *)(v14 - 64) = OutputBufferLength;
  *(_DWORD *)(v14 - 56) = v7;
  *(_DWORD *)(v14 - 48) = v9;
  if( (v9 & 3) == 0 )
  {
    if( (_DWORD)v7 || (_DWORD)OutputBufferLength )
    {
      if( (unsigned int)v7 >= (unsigned int)OutputBufferLength )
      {
        *((_QWORD *)v13 + 3) = InputBuffer;
      }
      else
      {
        *((_QWORD *)v13 + 3) = OutputBuffer;
        memmove((UINT8 *)OutputBuffer, (UINT8 *)InputBuffer, v7);
      }
      *((_DWORD *)v11 + 4) = 16;
      *((_QWORD *)v11 + 14) = OutputBuffer;
      if( OutputBuffer )
        *((_DWORD *)v11 + 4) |= 0x40u;
    }
    else
    {
      *((_DWORD *)v13 + 4) = 0;
      *((_QWORD *)v13 + 14) = 0i64;
    }
    goto LABEL_10;
  }
  if( v12 > 2 )
  {
    if( v12 == 3 )
    {
      *((_QWORD *)v13 + 14) = OutputBuffer;
      *(_QWORD *)(v14 - 40) = InputBuffer;
    }
    goto LABEL_10;
  }
  if( InputBuffer )
  {
    *((_QWORD *)v13 + 3) = InputBuffer;
    *((_DWORD *)v13 + 4) = 16;
  }
  else
  {
    *((_DWORD *)v13 + 4) = 0;
  }
  if( OutputBuffer )
  {
    Mdl = IoAllocateMdl(OutputBuffer, OutputBufferLength, 0, 0, 0i64);
    *((_QWORD *)v11 + 1) = Mdl;
    if( Mdl )
    {
      MmProbeAndLockPages(Mdl, 0, (_LOCK_OPERATION)(v12 != 1));
      goto LABEL_10;
    }
LABEL_21:
    v17 = -1073741670;
    goto LABEL_32;
  }
LABEL_10:
  v11 = Irp;
  *((_QWORD *)Irp + 19) = KeGetCurrentThread();
  *((_DWORD *)Irp + 4) |= 4u;
  *((_BYTE *)Irp + 64) = 0;
  v16 = *v26;
  *(_QWORD *)(v16 - 16) = SmKmGenericCompletion;
  *(_QWORD *)(v16 - 8) = &Object;
  *(_BYTE *)(v16 - 69) = 0;
  *(_BYTE *)(v16 - 69) = 64;
  *(_BYTE *)(v16 - 69) = -64;
  *(_BYTE *)(v16 - 69) = -32;
  if( IofCallDriver(DeviceObject, Irp) == 259 )
  {
    ObjectArray = &Object;
    if( (unsigned int)FsRtlCancellableWaitForMultipleObjects(1ui64, &ObjectArray, WaitAll, 0i64, 0i64, 0i64) == -1073741749 )
    {
      IoCancelIrp((KDPC *)Irp, v20, v21, v22);
      KeWaitForSingleObject(&Object, Executive, 0, 0, 0i64);
    }
  }
  v17 = *((_DWORD *)Irp + 12);
  v18 = *((_DWORD *)Irp + 14);
  *(_DWORD *)RetOutputBufferSize = v18;
  if( v17 >= 0 && v18 && (unsigned int)v7 >= (unsigned int)OutputBufferLength )
  {
    if( v18 < (unsigned int)OutputBufferLength )
      v15 = v18;
    memmove((UINT8 *)OutputBuffer, (UINT8 *)InputBuffer, v15);
  }
LABEL_32:
  if( v11 )
  {
    v23 = (struct _MDL *)*((_QWORD *)v11 + 1);
    if( v23 )
    {
      FsRtlpFreeMdlChain(v23);
      *((_QWORD *)v11 + 1) = 0i64;
    }
    IoFreeIrp(v11);
  }
  return v17;
}

Referenced by: