FsRtlAcquireFileForModWriteEx

NTSTATUS __stdcall FsRtlAcquireFileForModWriteEx(
        FILE_OBJECT *FileObject,
        LARGE_INTEGER *EndingOffset,
        ERESOURCE **ResourceToRelease){
  unsigned int v4; 
  char v5; 
  _DEVICE_OBJECT *RelatedDeviceObject; 
  UINT64 v7; 
  __int64 v8; 
  _DEVICE_OBJECT *BaseFileSystemDeviceObject; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  NTSTATUS v13; 
  LONGLONG *v14; 
  ERESOURCE **v15; 
  int v16; 
  char v17; 
  __int64(__fastcall *v18)(FILE_OBJECT *, LARGE_INTEGER *, ERESOURCE **, _DEVICE_OBJECT *); 
  __int64 v19; 
  void *FsContext; 
  char v21; 
  LONGLONG v22; 
  struct _ERESOURCE *v23; 
  char v24; 
  UINT8 v25; 
  UINT64 v26; 
  char v27; 
  _HHIVE *v28; 
  char v29; 
  int a4; 
  LARGE_INTEGER *v31; 
  ERESOURCE **v32; 
  INT64 *v33; 
  INT64 result[8]; 
  char v35; 
  v32 = ResourceToRelease;
  v31 = EndingOffset;
  memset((INT64)result, 0i64);
  v4 = 0;
  a4 = 0;
  v33 = result;
  v5 = 0;
  RelatedDeviceObject = IoGetRelatedDeviceObject(FileObject);
  BaseFileSystemDeviceObject = IoGetBaseFileSystemDeviceObject(FileObject);
  v10 = *((_QWORD *)BaseFileSystemDeviceObject + 1);
  v11 = *(_QWORD *)(v10 + 80);
  v12 = *(_QWORD *)(*(_QWORD *)(v10 + 48) + 48i64);
  if( v12 && (*(_DWORD *)v12 >= 0x50u && *(_QWORD *)(v12 + 72) || *(_DWORD *)v12 >= 0x58u && *(_QWORD *)(v12 + 80)) )
    v5 = 1;
  if( RelatedDeviceObject == BaseFileSystemDeviceObject && !v5 )
  {
    v15 = v32;
    v33 = 0i64;
    v17 = 0;
LABEL_12:
    if( !v12
      || (*(_DWORD *)v12 < 0x50u || !*(_QWORD *)(v12 + 72)) && (*(_DWORD *)v12 < 0x58u || !*(_QWORD *)(v12 + 80)) )
    {
      if( v11
        && *(_DWORD *)v11 >= 0x80u
        && (v18 = *(__int64(__fastcall **)(FILE_OBJECT *, LARGE_INTEGER *, ERESOURCE **, _DEVICE_OBJECT *))(v11 + 120)) != 0i64 )
      {
        v4 = v18(FileObject, v31, v15, BaseFileSystemDeviceObject);
      }
      else
      {
        v4 = -1073741808;
      }
      a4 |= 1u;
    }
    if( v17 )
      ObfDereferenceObjectWithTag(BaseFileSystemDeviceObject, 0x746C6644ui64);
    v14 = (LONGLONG *)v31;
    goto LABEL_25;
  }
  v13 = FsFilterCtrlInit((__int64)result, 253, (__int64)RelatedDeviceObject, v8, (__int64)FileObject, 1);
  if( v13 < 0 )
    return v13;
  v14 = (LONGLONG *)v31;
  v15 = v32;
  result[3] = (INT64)v31;
  result[4] = (INT64)v32;
  v16 = FsFilterPerformCallbacks((INT64)result, 1, 1, &a4);
  v4 = v16;
  if( v16 >= 0 )
  {
    if( v16 )
    {
      v4 = 0;
      if( v16 != 294 )
        v4 = v16;
      goto LABEL_25;
    }
    FileObject = (FILE_OBJECT *)result[2];
    if( (v35 & 4) != 0 )
    {
      BaseFileSystemDeviceObject = IoGetDeviceAttachmentBaseRefWithTag((DEVICE_OBJECT *)result[1], 0x746C6644ui64);
      v17 = 1;
      v19 = *((_QWORD *)BaseFileSystemDeviceObject + 1);
      v11 = *(_QWORD *)(v19 + 80);
      v12 = *(_QWORD *)(*(_QWORD *)(v19 + 48) + 48i64);
    }
    else
    {
      v17 = 0;
    }
    goto LABEL_12;
  }
LABEL_25:
  if( v4 == -1073741808 && (a4 & 1) != 0 )
  {
    FsContext = FileObject->FsContext;
    if( *((_QWORD *)FsContext + 1) )
    {
      v21 = *((_BYTE *)FsContext + 4);
      if( (v21 & 8) != 0 || (v22 = *((_QWORD *)FsContext + 5), *v14 > v22) && v22 != *((_QWORD *)FsContext + 4) )
      {
        v24 = 1;
      }
      else
      {
        if( (v21 & 0x10) == 0 )
        {
          v23 = (struct _ERESOURCE *)*((_QWORD *)FsContext + 2);
          if( v23 )
          {
            v24 = 0;
            goto LABEL_56;
          }
        }
        v24 = 0;
      }
      v23 = (struct _ERESOURCE *)*((_QWORD *)FsContext + 1);
      while( 1 )
      {
LABEL_56:
        if( v24 )
          v25 = ExAcquireResourceExclusiveLite(v23, 0);
        else
          ExAcquireSharedWaitForExclusive((_HHIVE *)v23, 0i64, v7);
        if( !v25 )
          goto LABEL_73;
        v27 = *((_BYTE *)FsContext + 4);
        if( (v27 & 8) != 0 || *v14 > *((_QWORD *)FsContext + 5) )
        {
          if( v24 )
            goto LABEL_45;
        }
        else
        {
          if( (v27 & 0x10) == 0 )
          {
            v28 = (_HHIVE *)*((_QWORD *)FsContext + 2);
            if( !v28 || v23 == (struct _ERESOURCE *)v28 )
            {
              if( v24 )
LABEL_44:
                ExConvertExclusiveToSharedLite(v23);
            }
            else
            {
              v23 = 0i64;
              ExAcquireSharedWaitForExclusive(v28, 0i64, v26);
              if( v29 )
                v23 = (struct _ERESOURCE *)*((_QWORD *)FsContext + 2);
              ExReleaseResourceLite(*((PERESOURCE *)FsContext + 1));
              if( !v23 )
              {
LABEL_73:
                v4 = -1073741608;
                goto LABEL_26;
              }
            }
LABEL_45:
            *v15 = v23;
            goto LABEL_46;
          }
          if( v24 )
            goto LABEL_44;
          if( v23 == *((struct _ERESOURCE **)FsContext + 1) )
            goto LABEL_45;
        }
        ExReleaseResourceLite(v23);
        v23 = (struct _ERESOURCE *)*((_QWORD *)FsContext + 1);
        v24 = 1;
      }
    }
    *v15 = 0i64;
LABEL_46:
    v4 = 0;
  }
LABEL_26:
  if( v33 )
  {
    if( *((_WORD *)v33 + 37) )
      FsFilterPerformCompletionCallbacks((__int64)result, v4);
    if( (v35 & 1) != 0 )
      FsFilterFreeCompletionStack((INT64)result);
  }
  return v4;
}

Referenced by: