CmpOpenFileWithExtremePrejudice
INT64 __stdcall CmpOpenFileWithExtremePrejudice(
PHANDLE FileHandle,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
UINT32 FileAttributes,
UINT32 a5){
INT64 result;
NTSTATUS v10;
UINT64 OpenOptions;
UINT64 v12;
UINT64 CreateDisposition;
UINT64 CreateOptions;
UINT64 v15;
void *FileHandlea;
struct _IO_STATUS_BLOCK IoStatusBlocka;
struct _FILE_BASIC_INFORMATION FileInformation;
FileHandlea = 0i64;
*FileHandle = 0i64;
IoStatusBlocka = 0i64;
memset(&FileInformation, 0, sizeof(FileInformation));
LODWORD(result) = ZwQueryAttributesFile(ObjectAttributes, &FileInformation);
if( (int)result >= 0 )
{
FileInformation.FileAttributes &= ~1u;
LODWORD(result) = ZwOpenFile((UNICODE_STRING *)&FileHandlea, (PWCHAR)0x100);
if( (int)result >= 0 )
{
v10 = ZwSetInformationFile(FileHandlea, &IoStatusBlocka, &FileInformation, 0x28ui64, FileBasicInformation);
ZwClose(FileHandlea);
if( v10 >= 0 )
{
LODWORD(v15) = 0;
LODWORD(CreateOptions) = a5;
LODWORD(CreateDisposition) = 1;
LODWORD(v12) = 0;
LODWORD(OpenOptions) = FileAttributes;
LODWORD(result) = ZwCreateFile(
FileHandle,
3ui64,
ObjectAttributes,
IoStatusBlock,
0i64,
OpenOptions,
v12,
CreateDisposition,
CreateOptions,
0i64,
v15);
}
else
{
return(unsigned int)v10;
}
}
}
return result;
}Referenced by:
CmpOpenHiveFile