SmKmStoreFileCreateForIoType
__int64 __fastcall SmKmStoreFileCreateForIoType(_OWORD *a1, const WCHAR *a2, int *a3, __int64 a4, int a5){
BOOL v8;
int v9;
UINT8 v10;
WCHAR v11;
int IsVolumeIoPossible;
OBJECT_ATTRIBUTES *v13;
IO_STATUS_BLOCK *v14;
__int128 v16;
__int128 v17;
__int128 v18;
LARGE_INTEGER *AllocationSize;
UINT64 FileAttributes;
UINT64 FileAttributesa;
UINT64 ShareAccess;
UINT64 ShareAccessa;
UINT64 Disposition;
UINT64 Dispositiona;
UINT64 CreateOptions;
UINT64 CreateOptionsa;
PVOID EaBuffer;
UINT64 EaLength;
UINT64 EaLengtha;
CREATE_FILE_TYPE CreateFileType;
PVOID InternalParameters;
UINT64 Options;
UINT64 Optionsa;
PVOID P;
void *FileHandle[2];
__int128 v37;
__int128 v38;
__int128 v39;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
struct _UNICODE_STRING DestinationString;
struct _IO_STATUS_BLOCK IoStatusBlock;
_SECURITY_DESCRIPTOR SecurityDescriptor[2];
PVOID Object;
UINT64 DesiredAccess;
LODWORD(DesiredAccess) = 0;
a5 = 0;
v8 = 0;
DestinationString = 0i64;
IoStatusBlock = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
memset(SecurityDescriptor, 0, 40);
memset((INT64)FileHandle, 0i64);
P = 0i64;
if( a3 )
{
v9 = 0;
}
else
{
v9 = 1;
a3 = &a5;
}
v10 = IoSetThreadHardErrorMode(0);
RtlInitUnicodeString(&DestinationString, a2, v11);
IsVolumeIoPossible = SmKmStoreFileMakeSecurityDescriptor(SecurityDescriptor, (_ACL **)&P);
if( IsVolumeIoPossible >= 0 )
{
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
ObjectAttributes.SecurityQualityOfService = 0i64;
while( 1 )
{
LODWORD(Options) = *a3 != 0 ? 264 : 266;
LODWORD(EaLength) = 0;
LODWORD(CreateOptions) = 32778;
LODWORD(Disposition) = 0;
LODWORD(ShareAccess) = 0;
LODWORD(FileAttributes) = 0x2000;
IsVolumeIoPossible = IoCreateFile(
FileHandle,
0x140003ui64,
&ObjectAttributes,
&IoStatusBlock,
0i64,
FileAttributes,
ShareAccess,
Disposition,
CreateOptions,
0i64,
EaLength,
CreateFileTypeNone,
0i64,
Options);
if( IsVolumeIoPossible < 0 )
break;
Object = 0i64;
IsVolumeIoPossible = ObReferenceObjectByHandle(FileHandle[0], 0x10003u, 0i64, 0, &Object, 0i64);
FileHandle[1] = Object;
if( IsVolumeIoPossible < 0 )
break;
v8 = !*a3 || (IoStatusBlock.Information & 0xFFFFFFFFFFFFFFFDui64) == 0;
IsVolumeIoPossible = ZwSetSecurityObject(FileHandle[0], 4ui64, SecurityDescriptor);
if( IsVolumeIoPossible < 0 )
break;
if( *a3 )
goto LABEL_25;
IsVolumeIoPossible = SmKmIsVolumeIoPossible(
FileHandle,
(UINT64)&DesiredAccess,
v13,
v14,
AllocationSize,
FileAttributesa,
ShareAccessa,
Dispositiona,
CreateOptionsa,
EaBuffer,
EaLengtha,
CreateFileType,
InternalParameters,
Optionsa);
if( IsVolumeIoPossible < 0 )
break;
if( (_DWORD)DesiredAccess )
{
LABEL_25:
v16 = v37;
*a1 = *(_OWORD *)FileHandle;
v17 = v38;
a1[1] = v16;
v18 = v39;
a1[2] = v17;
a1[3] = v18;
memset((INT64)FileHandle, 0i64);
IsVolumeIoPossible = 0;
goto LABEL_22;
}
if( v9 )
{
IsVolumeIoPossible = -1073741637;
break;
}
*a3 = 1;
if( v8 )
SmKmStoreFileDelete((__int64)FileHandle);
SmKmFileInfoCleanup((__int64)FileHandle);
memset((INT64)FileHandle, 0i64);
v8 = 0;
}
if( v8 )
SmKmStoreFileDelete((__int64)FileHandle);
}
LABEL_22:
SmKmFileInfoCleanup((__int64)FileHandle);
if( P )
ExFreePoolWithTag(P, 0);
IoSetThreadHardErrorMode(v10);
return(unsigned int)IsVolumeIoPossible;
}Referenced by:
SmKmStoreFileCreate