VfZwCreateFile

NTSTATUS __stdcall VfZwCreateFile(
        VOID **FileHandle,
        UINT64 DesiredAccess,
        ULONG_PTR ObjectAttributes,
        ULONG_PTR IoStatusBlock,
        ULONG_PTR AllocationSize,
        UINT64 FileAttributes,
        UINT64 ShareAccess,
        UINT64 CreateDisposition,
        UINT64 CreateOptions,
        VOID *EaBuffer,
        UINT64 EaLength){
  UINT64 v11; 
  _OBJECT_ATTRIBUTES *v12; 
  unsigned int v13; 
  VOID *retaddr; 

  v11 = *(_QWORD *)&IoStatusBlock;
  v12 = *(_OBJECT_ATTRIBUTES **)&ObjectAttributes;
  v13 = DesiredAccess;
  if( (unsigned int)ViZwShouldCheck() )
  {
    ViZwCheckVirtualAddress((UINT64)FileHandle, retaddr);
    ViZwCheckObjectAttributes(v12, retaddr);
    ViZwCheckVirtualAddress(v11, retaddr);
    ViZwCheckVirtualAddress(*(UINT64 *)&AllocationSize, retaddr);
    ViZwCheckVirtualAddress((UINT64)EaBuffer, retaddr);
  }
  return((__int64(__fastcall *)(VOID **, _QWORD, _OBJECT_ATTRIBUTES *, UINT64, _QWORD, _DWORD, _DWORD, _DWORD, _DWORD, VOID *, _DWORD))pXdvZwCreateFile)(
           FileHandle,
           v13,
           v12,
           v11,
           *(_QWORD *)&AllocationSize,
           FileAttributes,
           ShareAccess,
           CreateDisposition,
           CreateOptions,
           EaBuffer,
           EaLength);
}

Referenced by: