FsRtlSetKernelEaFile

NTSTATUS __stdcall FsRtlSetKernelEaFile(_FILE_OBJECT *FileObject, PVOID EaBuffer, UINT64 a3){
  int v3; 
  _IRP *v6; 
  _IRP *v7; 
  __int64 *v8; 
  __int64 v9; 
  __int64 v10; 
  NTSTATUS v11; 
  void *v12; 
  void *v13; 
  void *v14; 
  struct _MDL *v15; 
  PIRP Irp; 
  PVOID ObjectArray; 
  _KEVENT Object; 
  _DEVICE_OBJECT *DeviceObject; 
  v3 = a3;
  v6 = 0i64;
  memset(&Object, 0, sizeof(Object));
  KeInitializeEvent(&Object, NotificationEvent, 0);
  if( (FileObject->Flags & 0x800) != 0 )
  {
    v11 = -1073741808;
  }
  else
  {
    DeviceObject = IoGetRelatedDeviceObject(FileObject);
    v7 = IoAllocateIrpEx(DeviceObject, *((_BYTE *)DeviceObject + 76), 0);
    v6 = v7;
    Irp = v7;
    if( v7 )
    {
      v8 = (__int64 *)((char *)v7 + 184);
      v9 = *((_QWORD *)v7 + 23);
      *(_WORD *)(v9 - 72) = 1032;
      *(_QWORD *)(v9 - 24) = FileObject;
      *((_QWORD *)v6 + 14) = EaBuffer;
      *(_DWORD *)(v9 - 64) = v3;
      v6 = Irp;
      *((_QWORD *)Irp + 19) = KeGetCurrentThread();
      *((_DWORD *)Irp + 4) = 4;
      *((_BYTE *)Irp + 64) = 0;
      v10 = *v8;
      *(_QWORD *)(v10 - 16) = SmKmGenericCompletion;
      *(_QWORD *)(v10 - 8) = &Object;
      *(_BYTE *)(v10 - 69) = 0;
      *(_BYTE *)(v10 - 69) = 64;
      *(_BYTE *)(v10 - 69) = -64;
      *(_BYTE *)(v10 - 69) = -32;
      if( IofCallDriver(DeviceObject, Irp) == 259 )
      {
        ObjectArray = &Object;
        if( (unsigned int)FsRtlCancellableWaitForMultipleObjects(1ui64, &ObjectArray, WaitAll, 0i64, 0i64, 0i64) == -1073741749 )
        {
          IoCancelIrp((KDPC *)Irp, v12, v13, v14);
          KeWaitForSingleObject(&Object, Executive, 0, 0, 0i64);
        }
      }
      v11 = *((_DWORD *)Irp + 12);
    }
    else
    {
      v11 = -1073741670;
    }
  }
  if( v6 )
  {
    v15 = (struct _MDL *)*((_QWORD *)v6 + 1);
    if( v15 )
    {
      FsRtlpFreeMdlChain(v15);
      *((_QWORD *)v6 + 1) = 0i64;
    }
    IoFreeIrp(v6);
  }
  return v11;
}

Referenced by: