SbpStartLanman

NTSTATUS __stdcall SbpStartLanman(){
  VOID **v0; 
  VOID **v1; 
  NTSTATUS DeviceObjectPointer; 
  PFILE_OBJECT v3; 
  int Status; 
  VOID **OutputBuffer; 
  _DEVICE_OBJECT *v6; 
  _IRP *v7; 
  UINT64 v8; 
  _IO_STACK_LOCATION *CurrentStackLocation; 
  PDEVICE_OBJECT v10; 
  VOID **PoolWithTag; 
  _DEVICE_OBJECT *v12; 
  _IRP *v13; 
  UINT64 v14; 
  _IO_STACK_LOCATION *v15; 
  PDEVICE_OBJECT v16; 
  UINT64 OutputBufferLength; 
  UINT64 OutputBufferLengtha; 
  __int128 Object; 
  __int64 v21; 
  PDEVICE_OBJECT DeviceObject; 
  PFILE_OBJECT FileObject; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 InputBuffer[2]; 
  int v26; 
  VOID *ReturnAddress; 

  DeviceObject = 0i64;
  v21 = 0i64;
  v26 = 0;
  Object = 0i64;
  FileObject = 0i64;
  v0 = 0i64;
  IoStatusBlock = 0i64;
  v1 = 0i64;
  memset(InputBuffer, 0, sizeof(InputBuffer));
  DeviceObjectPointer = IoGetDeviceObjectPointer(
                          (_UNICODE_STRING *)&LanmanRedirectorName,
                          0x10000000ui64,
                          &FileObject,
                          &DeviceObject);
  v3 = FileObject;
  Status = DeviceObjectPointer;
  if( DeviceObjectPointer < 0 )
    goto LABEL_12;
  OutputBuffer = ExAllocatePoolWithTag(0x200ui64, 0x8Cui64, 1113746771i64);
  v1 = OutputBuffer;
  if( !OutputBuffer )
    goto LABEL_3;
  *((_DWORD *)OutputBuffer + 15) = -1;
  *((_DWORD *)OutputBuffer + 4) = 5;
  *(_DWORD *)OutputBuffer = 3600;
  *((_DWORD *)OutputBuffer + 2) = 16;
  *((_DWORD *)OutputBuffer + 1) = 250;
  *((_DWORD *)OutputBuffer + 3) = 600;
  *((_DWORD *)OutputBuffer + 5) = 45;
  *((_DWORD *)OutputBuffer + 9) = 10;
  *((_DWORD *)OutputBuffer + 6) = 512;
  *((_DWORD *)OutputBuffer + 7) = 17;
  *((_DWORD *)OutputBuffer + 8) = 6144;
  *((_DWORD *)OutputBuffer + 10) = 500;
  *((_DWORD *)OutputBuffer + 12) = 500;
  *((_DWORD *)OutputBuffer + 11) = 10;
  *((_DWORD *)OutputBuffer + 14) = 45;
  *((_DWORD *)OutputBuffer + 18) = 5;
  v6 = DeviceObject;
  *((_DWORD *)OutputBuffer + 13) = 40;
  *((_DWORD *)OutputBuffer + 16) = 3;
  *((_DWORD *)OutputBuffer + 17) = 20;
  *(VOID **)((char *)OutputBuffer + 76) = (VOID *)60;
  *((_DWORD *)OutputBuffer + 21) = 1;
  *((_DWORD *)OutputBuffer + 22) = 1;
  *((_DWORD *)OutputBuffer + 23) = 1;
  *((_DWORD *)OutputBuffer + 24) = 1;
  *((_DWORD *)OutputBuffer + 25) = 1;
  *((_DWORD *)OutputBuffer + 26) = 1;
  *((_DWORD *)OutputBuffer + 27) = 1;
  *((_DWORD *)OutputBuffer + 28) = 1;
  *((_DWORD *)OutputBuffer + 29) = 1;
  *((_DWORD *)OutputBuffer + 30) = 1;
  *((_DWORD *)OutputBuffer + 31) = 1;
  *((_DWORD *)OutputBuffer + 32) = 1;
  *(VOID **)((char *)OutputBuffer + 132) = (VOID *)1;
  v21 = (__int64)&Object + 8;
  *((_QWORD *)&Object + 1) = (char *)&Object + 8;
  LODWORD(OutputBufferLength) = 140;
  LOWORD(Object) = 1;
  BYTE2(Object) = 6;
  DWORD1(Object) = 0;
  v7 = IopBuildDeviceIoControlRequest(
         0x80140191ui64,
         v6,
         InputBuffer,
         0x24ui64,
         OutputBuffer,
         OutputBufferLength,
         0,
         (_KEVENT *)&Object,
         &IoStatusBlock,
         ReturnAddress);
  v8 = (UINT64)v7;
  if( !v7 )
    goto LABEL_3;
  CurrentStackLocation = v7->Tail.CurrentStackLocation;
  v10 = DeviceObject;
  CurrentStackLocation[-1].FileObject = v3;
  CurrentStackLocation[-1].MajorFunction = 13;
  Status = IofCallDriver((UINT64)v10, v8);
  if( Status == 259 )
  {
    KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
    Status = IoStatusBlock.Status;
  }
  if( Status >= 0 )
  {
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x76ui64, 1113746771i64);
    v0 = PoolWithTag;
    if( PoolWithTag )
    {
      memset(PoolWithTag, 0i64, 0x76u);
      *((_BYTE *)v0 + 65) |= 1u;
      *((_DWORD *)v0 + 17) = -1;
      v12 = DeviceObject;
      *((_WORD *)v0 + 6) = 94;
      *((_BYTE *)v0 + 84) = 1;
      *((_DWORD *)v0 + 19) = 30;
      *((_WORD *)v0 + 43) = 26;
      *((_DWORD *)v0 + 20) = 30;
      *((_DWORD *)v0 + 8) = 20;
      *((_DWORD *)v0 + 10) = 20;
      *((_DWORD *)v0 + 6) = 30;
      *((_BYTE *)v0 + 64) = 31;
      *((_DWORD *)v0 + 18) = 10;
      *((_DWORD *)v0 + 5) = 120;
      *((_DWORD *)v0 + 7) = 0x8000;
      *((_DWORD *)v0 + 9) = 5;
      *((_DWORD *)v0 + 11) = 2048;
      *((_DWORD *)v0 + 12) = 32;
      *((_DWORD *)v0 + 13) = 512;
      *((_DWORD *)v0 + 14) = 0x1000000;
      *((_DWORD *)v0 + 15) = 0x100000;
      *(_OWORD *)(v0 + 11) = *(_OWORD *)L"\\Device\\vmsmb";
      v0[13] = *(VOID **)L"vmsmb";
      *((_WORD *)v0 + 56) = aDeviceVmsmb[12];
      v21 = (__int64)&Object + 8;
      *((_QWORD *)&Object + 1) = (char *)&Object + 8;
      LODWORD(OutputBufferLengtha) = 0;
      LOWORD(Object) = 1;
      BYTE2(Object) = 6;
      DWORD1(Object) = 0;
      v13 = IopBuildDeviceIoControlRequest(
              0x1403A0ui64,
              v12,
              v0,
              0x76ui64,
              0i64,
              OutputBufferLengtha,
              0,
              (_KEVENT *)&Object,
              &IoStatusBlock,
              ReturnAddress);
      v14 = (UINT64)v13;
      if( v13 )
      {
        v15 = v13->Tail.CurrentStackLocation;
        v16 = DeviceObject;
        v15[-1].FileObject = v3;
        v15[-1].MajorFunction = 13;
        Status = IofCallDriver((UINT64)v16, v14);
        if( Status == 259 )
        {
          KeWaitForSingleObject((UINT64)&Object, 0, 0, 0, 0i64);
          Status = IoStatusBlock.Status;
        }
        goto LABEL_12;
      }
    }
LABEL_3:
    Status = -1073741670;
  }
LABEL_12:
  if( v3 )
    ObfDereferenceObjectWithTag(v3, 0x746C6644ui64);
  if( v1 )
    ExFreeHeapPool(v1);
  if( v0 )
    ExFreeHeapPool(v0);
  return Status;
}

Referenced by: