ObCreateSiloRootDirectory

NTSTATUS __stdcall ObCreateSiloRootDirectory(_EJOB *Silo, UINT64 Flags){
  _ADAPTER_OBJECT *v2; 
  _ADAPTER_OBJECT *v3; 
  char v4; 
  INT64 v6; 
  __int64 v7; 
  __int64 v8; 
  PKINTERRUPT_ROUTINE **v9; 
  UINT32 v10; 
  PKINTERRUPT_ROUTINE *v11; 
  __int64 v12; 
  INT64 v14; 
  _EJOB *v15; 
  _EJOB *v16; 
  UINT64 v17; 
  int SilosRootDirectory; 
  NTSTATUS v19; 
  void *v20; 
  PVOID *Object; 
  _HANDLE Handle[2]; 
  void *ReturnedSiloContext; 
  PVOID DosDevicesShadowDirectory; 
  VOID *RootHandle; 
  VOID *DirectoryHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID v28; 
  _UNICODE_STRING String; 
  char v30; 

  DosDevicesShadowDirectory = 0i64;
  RootHandle = 0i64;
  v2 = 0i64;
  DirectoryHandle = 0i64;
  v3 = 0i64;
  *(_QWORD *)Handle = 0i64;
  v4 = Flags;
  ReturnedSiloContext = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( (Flags & 0xFFFFFFF8) != 0 || (Flags & 6) == 4 || !PsIsJobParentImmutable((INT64)Silo) )
    return -1073741811;
  LODWORD(v7) = PsGetParentSilo(v6);
  v8 = v7;
  LODWORD(v12) = HalSystemVectorDispatchEntry(v10, v9, v11);
  if( v8 != v12 )
    return -1073740007;
  LODWORD(v14) = PsGetParentSilo((INT64)Silo);
  LODWORD(v15) = PsAttachSiloToCurrentThread(v14);
  v16 = v15;
  *(_QWORD *)&String.Length = 1441792i64;
  String.Buffer = (wchar_t *)&v30;
  if( Silo )
    v17 = *((unsigned int *)Silo + 309);
  else
    v17 = 0i64;
  SilosRootDirectory = RtlIntegerToUnicodeString(v17, 0xAui64, &String);
  if( SilosRootDirectory >= 0 )
  {
    SilosRootDirectory = ObpGetSilosRootDirectory(&RootHandle);
    if( SilosRootDirectory >= 0 )
    {
      if( (v4 & 1) == 0
        || (ObjectAttributes.RootDirectory = 0i64,
            ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpRootDirectoryName,
            ObjectAttributes.Length = 48,
            ObjectAttributes.Attributes = 512,
            *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
            SilosRootDirectory = ZwOpenDirectoryObject(&DirectoryHandle, 3, &ObjectAttributes),
            SilosRootDirectory >= 0) )
      {
        ObjectAttributes.SecurityQualityOfService = 0i64;
        LODWORD(Object) = 0;
        ObjectAttributes.RootDirectory = RootHandle;
        ObjectAttributes.ObjectName = &String;
        ObjectAttributes.SecurityDescriptor = (void *)SePublicDefaultUnrestrictedSd;
        ObjectAttributes.Length = 48;
        ObjectAttributes.Attributes = 592;
        SilosRootDirectory = ZwCreateDirectoryObjectEx(
                               (VOID **)Handle,
                               0xF000Fui64,
                               &ObjectAttributes,
                               DirectoryHandle,
                               (UINT64)Object);
        if( SilosRootDirectory >= 0 )
        {
          v28 = 0i64;
          v19 = ObReferenceObjectByHandle(*(VOID **)Handle, 0xF000Fui64, DmaAdapter, 0, &v28, 0i64);
          v2 = (_ADAPTER_OBJECT *)v28;
          SilosRootDirectory = v19;
          if( v19 >= 0 )
          {
            SilosRootDirectory = PsCreateSiloContext(
                                   (INT64)Silo,
                                   8ui64,
                                   1i64,
                                   (INT64)ObpDirectoryTeardownCallback,
                                   (INT64 *)&ReturnedSiloContext);
            if( SilosRootDirectory < 0 )
            {
              v3 = (_ADAPTER_OBJECT *)ReturnedSiloContext;
            }
            else
            {
              ObfReferenceObjectWithTag(v2, 0x7254624Fui64);
              v3 = (_ADAPTER_OBJECT *)ReturnedSiloContext;
              v20 = ReturnedSiloContext;
              *(_QWORD *)ReturnedSiloContext = v2;
              SilosRootDirectory = PsInsertSiloContext(Silo, (unsigned int)PsObjectDirectoryTeardownSlot, v20);
              if( SilosRootDirectory >= 0 )
              {
                SilosRootDirectory = PsInsertPermanentSiloContextEx(
                                       Silo,
                                       (unsigned int)PsObjectDirectorySiloContextSlot,
                                       v2,
                                       1i64);
                if( SilosRootDirectory >= 0 && (v4 & 2) != 0 )
                {
                  if( (v4 & 4) == 0
                    || (ObjectAttributes.RootDirectory = 0i64,
                        ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalDosDevicesShortName,
                        ObjectAttributes.Length = 48,
                        ObjectAttributes.Attributes = 512,
                        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
                        SilosRootDirectory = ZwOpenDirectoryObject(&DosDevicesShadowDirectory, 3, &ObjectAttributes),
                        SilosRootDirectory >= 0) )
                  {
                    SilosRootDirectory = ObpInitializeRootNamespace(Silo, *(VOID **)Handle, DosDevicesShadowDirectory);
                  }
                }
              }
            }
          }
        }
      }
    }
  }
  if( DosDevicesShadowDirectory )
    ZwClose((_HANDLE)DosDevicesShadowDirectory);
  if( RootHandle )
    ZwClose((_HANDLE)RootHandle);
  if( *(_QWORD *)Handle )
    ZwClose(Handle[0]);
  if( v2 )
    HalPutDmaAdapter(v2);
  if( DirectoryHandle )
    ZwClose((_HANDLE)DirectoryHandle);
  if( v3 )
    HalPutDmaAdapter(v3);
  PsDetachSiloFromCurrentThread(v16);
  return SilosRootDirectory;
}

Referenced by: