RtlCreateSystemVolumeInformationFolder

NTSTATUS __stdcall RtlCreateSystemVolumeInformationFolder(_UNICODE_STRING *VolumeRootPath){
  unsigned int Length; 
  size_t v3; 
  unsigned __int16 v4; 
  wchar_t v5; 
  UINT64 v6; 
  VOID **PoolWithTag; 
  unsigned __int64 v8; 
  int v9; 
  _ACL *v10; 
  INT64 v11; 
  INT64 v12; 
  _ACL *v13; 
  _LARGE_INTEGER *AllocationSize; 
  UINT64 FileAttributes; 
  UINT64 FileAttributesa; 
  UINT64 FileAttributesb; 
  UINT64 ShareAccess; 
  UINT64 ShareAccessa; 
  UINT64 ShareAccessb; 
  UINT64 CreateDisposition; 
  UINT64 CreateDispositiona; 
  UINT64 CreateDispositionb; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  UINT64 EaLength; 
  UINT64 EaLengtha; 
  UINT64 EaLengthb; 
  PVOID P[2]; 
  _UNICODE_STRING DestinationString; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 
  _ACL *Acl; 
  PVOID SecurityDescriptor; 

  SecurityDescriptor = 0i64;
  Acl = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  FileHandle = 0i64;
  *(_OWORD *)P = 0i64;
  IoStatusBlock = 0i64;
  RtlInitUnicodeString(&DestinationString, L"System Volume Information");
  Length = VolumeRootPath->Length;
  v3 = DestinationString.Length;
  v4 = DestinationString.Length + Length;
  LOWORD(P[0]) = DestinationString.Length + Length;
  if( (unsigned __int16)(DestinationString.Length + Length) < (unsigned __int16)Length || v4 < DestinationString.Length )
    return -1073741811;
  v5 = VolumeRootPath->Buffer[((unsigned __int64)Length >> 1) - 1];
  if( v5 != 92 )
  {
    v4 += 2;
    LOWORD(P[0]) = v4;
  }
  v6 = (unsigned __int16)(v4 + 2);
  WORD1(P[0]) = v6;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v6, 1399615318i64);
  P[1] = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove(PoolWithTag, VolumeRootPath->Buffer, VolumeRootPath->Length);
  v8 = VolumeRootPath->Length;
  LOWORD(P[0]) = VolumeRootPath->Length;
  if( v5 != 92 )
  {
    *((_WORD *)P[1] + (v8 >> 1)) = 92;
    LOWORD(v8) = LOWORD(P[0]) + 2;
    LOWORD(P[0]) += 2;
  }
  memmove((char *)P[1] + (unsigned __int16)v8, DestinationString.Buffer, v3);
  LOWORD(P[0]) += v3;
  *((_WORD *)P[1] + ((unsigned __int64)LOWORD(P[0]) >> 1)) = 0;
  v9 = RtlpSysVolCreateSecurityDescriptor(&SecurityDescriptor, &Acl);
  if( v9 < 0 )
  {
    v13 = (_ACL *)P[1];
  }
  else
  {
    v10 = (_ACL *)SecurityDescriptor;
    LODWORD(EaLength) = 0;
    LODWORD(CreateOptions) = 2101344;
    LODWORD(CreateDisposition) = 1;
    LODWORD(ShareAccess) = 7;
    LODWORD(FileAttributes) = 0;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)P;
    ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
    ObjectAttributes.SecurityQualityOfService = 0i64;
    if( NtCreateFile(
           &FileHandle,
           0x10000ui64,
           &ObjectAttributes,
           &IoStatusBlock,
           0i64,
           FileAttributes,
           ShareAccess,
           CreateDisposition,
           CreateOptions,
           0i64,
           EaLength) >= 0 )
      NtClose((UINT64)FileHandle);
    LODWORD(EaLengtha) = 0;
    LODWORD(CreateOptionsa) = 33;
    LODWORD(CreateDispositiona) = 3;
    LODWORD(ShareAccessa) = 7;
    LODWORD(FileAttributesa) = 6;
    v9 = NtCreateFile(
           &FileHandle,
           0x1E0000ui64,
           &ObjectAttributes,
           &IoStatusBlock,
           0i64,
           FileAttributesa,
           ShareAccessa,
           CreateDispositiona,
           CreateOptionsa,
           0i64,
           EaLengtha);
    if( v9 < 0 )
    {
      RtlpSysVolTakeOwnership((_UNICODE_STRING *)P);
      LODWORD(EaLengthb) = 0;
      LODWORD(CreateOptionsb) = 33;
      LODWORD(CreateDispositionb) = 3;
      LODWORD(ShareAccessb) = 7;
      LODWORD(FileAttributesb) = 6;
      v9 = NtCreateFile(
             &FileHandle,
             0x1E0000ui64,
             &ObjectAttributes,
             &IoStatusBlock,
             0i64,
             FileAttributesb,
             ShareAccessb,
             CreateDispositionb,
             CreateOptionsb,
             0i64,
             EaLengthb);
    }
    ExFreePoolWithTag(P[1], 0);
    if( v9 < 0 )
    {
      ExFreePoolWithTag(Acl, 0);
      v13 = v10;
    }
    else
    {
      ExFreePoolWithTag(v10, 0);
      v9 = RtlpSysVolCheckOwnerAndSecurity(
             FileHandle,
             Acl,
             v11,
             v12,
             (INT64)AllocationSize,
             FileAttributesb,
             ShareAccessb,
             CreateDispositionb);
      NtClose((UINT64)FileHandle);
      v13 = Acl;
    }
  }
  ExFreePoolWithTag(v13, 0);
  return v9;
}

Referenced by: