ObpCreateDosDevicesDirectory

INT64 __stdcall ObpCreateDosDevicesDirectory(_EJOB *Silo, PVOID RootHandle){
  void *v2; 
  void *v3; 
  INT64 result; 
  int v7; 
  WCHAR v8; 
  UINT64 Flags; 
  char DaclDefaulted[8]; 
  void *SymbolicLinkHandle; 
  HANDLE Handle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  PACL Dacl; 
  __int128 SecurityDescriptor[2]; 
  __int64 v16; 
  struct _UNICODE_STRING DestinationString; 
  unsigned __int8 DaclPresent; 
  Handle = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v16 = 0i64;
  v3 = v2;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  SymbolicLinkHandle = 0i64;
  DestinationString = 0i64;
  if( PsIsHostSilo(Silo) && v3 )
    return 3221225485i64;
  result = ObpGetDosDevicesProtection(SecurityDescriptor);
  if( (int)result >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalDirectoryName;
    ObjectAttributes.RootDirectory = RootHandle;
    ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
    ObjectAttributes.Attributes = 528;
    ObjectAttributes.SecurityQualityOfService = 0i64;
    LODWORD(Flags) = 0;
    v7 = ZwCreateDirectoryObjectEx(&Handle, 0xF000Fui64, &ObjectAttributes, v3, Flags);
    if( v7 < 0 )
    {
      Handle = 0i64;
    }
    else
    {
      v7 = ObpSetSiloDeviceMap(Silo, Handle);
      if( v7 >= 0 )
      {
        RtlInitUnicodeString(&DestinationString, &word_1407CF120, v8);
        ObjectAttributes.RootDirectory = Handle;
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalRootNameString;
        ObjectAttributes.Attributes = 528;
        ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
        ObjectAttributes.SecurityQualityOfService = 0i64;
        v7 = ZwCreateSymbolicLinkObject(&SymbolicLinkHandle, 0xF0001ui64, &ObjectAttributes, &DestinationString);
        if( v7 >= 0 )
        {
          ZwClose(SymbolicLinkHandle);
          ObjectAttributes.RootDirectory = Handle;
          ObjectAttributes.Length = 48;
          ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpGlobalNameString;
          ObjectAttributes.Attributes = 528;
          ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
          ObjectAttributes.SecurityQualityOfService = 0i64;
          v7 = ZwCreateSymbolicLinkObject(
                 &SymbolicLinkHandle,
                 0xF0001ui64,
                 &ObjectAttributes,
                 (UNICODE_STRING *)&ObpGlobalDosDevicesShortName);
          if( v7 >= 0 )
          {
            ZwClose(SymbolicLinkHandle);
            ObjectAttributes.Length = 48;
            ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpDosDevicesNameString;
            ObjectAttributes.RootDirectory = RootHandle;
            ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
            ObjectAttributes.Attributes = 528;
            ObjectAttributes.SecurityQualityOfService = 0i64;
            v7 = ZwCreateSymbolicLinkObject(
                   &SymbolicLinkHandle,
                   0xF0001ui64,
                   &ObjectAttributes,
                   (UNICODE_STRING *)&ObpDosDevicesShortNameRootString);
            if( v7 >= 0 )
              ZwClose(SymbolicLinkHandle);
          }
        }
      }
    }
    DaclPresent = 0;
    Dacl = 0i64;
    RtlGetDaclSecurityDescriptor(SecurityDescriptor, &DaclPresent, &Dacl, (UINT8 *)DaclDefaulted);
    ExFreePoolWithTag(Dacl, 0x6C636144u);
    if( Handle )
      ZwClose(Handle);
    return(unsigned int)v7;
  }
  return result;
}

Referenced by: