ObpCreateDosDevicesDirectory

NTSTATUS __stdcall ObpCreateDosDevicesDirectory(_EJOB *Silo, VOID *RootHandle, VOID *ShadowDirectoryHandle){
  NTSTATUS result; 
  int v7; 
  UINT64 Flags; 
  char DaclDefaulted[8]; 
  VOID *LinkHandle; 
  VOID *DirectoryHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PACL Dacl; 
  __int128 SecurityDescriptor[2]; 
  __int64 v15; 
  _UNICODE_STRING DestinationString; 
  unsigned __int8 DaclPresent; 

  DirectoryHandle = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v15 = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LinkHandle = 0i64;
  DestinationString = 0i64;
  if( PsIsHostSilo(Silo) && ShadowDirectoryHandle )
    return -1073741811;
  result = ObpGetDosDevicesProtection(SecurityDescriptor);
  if( result >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalDirectoryName;
    ObjectAttributes.RootDirectory = RootHandle;
    ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
    ObjectAttributes.Attributes = 528;
    ObjectAttributes.SecurityQualityOfService = 0i64;
    LODWORD(Flags) = 0;
    v7 = ZwCreateDirectoryObjectEx(&DirectoryHandle, 0xF000Fui64, &ObjectAttributes, ShadowDirectoryHandle, Flags);
    if( v7 < 0 )
    {
      DirectoryHandle = 0i64;
    }
    else
    {
      v7 = ObpSetSiloDeviceMap(Silo, DirectoryHandle);
      if( v7 >= 0 )
      {
        RtlInitUnicodeString(&DestinationString, (PCWSTR)&dword_1407CF120);
        ObjectAttributes.RootDirectory = DirectoryHandle;
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalRootNameString;
        ObjectAttributes.Attributes = 528;
        ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
        ObjectAttributes.SecurityQualityOfService = 0i64;
        v7 = ZwCreateSymbolicLinkObject(&LinkHandle, 983041, &ObjectAttributes, &DestinationString);
        if( v7 >= 0 )
        {
          ZwClose((_HANDLE)LinkHandle);
          ObjectAttributes.RootDirectory = DirectoryHandle;
          ObjectAttributes.Length = 48;
          ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalNameString;
          ObjectAttributes.Attributes = 528;
          ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
          ObjectAttributes.SecurityQualityOfService = 0i64;
          v7 = ZwCreateSymbolicLinkObject(
                 &LinkHandle,
                 983041,
                 &ObjectAttributes,
                 (_UNICODE_STRING *)&ObpGlobalDosDevicesShortName);
          if( v7 >= 0 )
          {
            ZwClose((_HANDLE)LinkHandle);
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpDosDevicesNameString;
            ObjectAttributes.RootDirectory = RootHandle;
            ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
            ObjectAttributes.Attributes = 528;
            ObjectAttributes.SecurityQualityOfService = 0i64;
            v7 = ZwCreateSymbolicLinkObject(
                   &LinkHandle,
                   983041,
                   &ObjectAttributes,
                   (_UNICODE_STRING *)&ObpDosDevicesShortNameRootString);
            if( v7 >= 0 )
              ZwClose((_HANDLE)LinkHandle);
          }
        }
      }
    }
    DaclPresent = 0;
    Dacl = 0i64;
    RtlGetDaclSecurityDescriptor(SecurityDescriptor, &DaclPresent, &Dacl, (UINT8 *)DaclDefaulted);
    ExFreePoolWithTag(Dacl, 0x6C636144u);
    if( DirectoryHandle )
      ZwClose((_HANDLE)DirectoryHandle);
    return v7;
  }
  return result;
}

Referenced by: