PpLastGoodDeleteFilesCallback

NTSTATUS __stdcall PpLastGoodDeleteFilesCallback(
        _UNICODE_STRING *FullPathName,
        _UNICODE_STRING *FileName,
        UINT64 FileAttributes,
        VOID *Context,
        INT64 a5,
        INT64 a6,
        INT64 a7){
  char v7; 
  NTSTATUS result; 
  INT64 ShareAccess; 
  UINT64 ShareAccessb; 
  UINT64 ShareAccessa; 
  INT64 OpenOptions; 
  UINT64 OpenOptionsa; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 
  INT8 FileInformation; 

  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  v7 = FileAttributes;
  FileHandle = 0i64;
  IopFileUtilClearAttributes(
    FullPathName,
    (UINT64)FileName,
    FileAttributes,
    (INT64)Context,
    ShareAccess,
    OpenOptions,
    0i64,
    0i64);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 64;
  ObjectAttributes.ObjectName = FullPathName;
  LODWORD(OpenOptionsa) = (v7 & 0x10) != 0 ? 2113537 : 2113600;
  LODWORD(ShareAccessb) = 7;
  result = ZwOpenFile(&FileHandle, 0x10080ui64, &ObjectAttributes, &IoStatusBlock, ShareAccessb, OpenOptionsa);
  if( result >= 0 )
  {
    FileInformation = 1;
    LODWORD(ShareAccessa) = 13;
    ZwSetInformationFile((UINT64)FileHandle, (UINT64)&IoStatusBlock, &FileInformation, 1ui64, ShareAccessa);
    ZwClose((_HANDLE)FileHandle);
    return 0;
  }
  return result;
}

Referenced by: