NtQueryFullAttributesFile

NTSTATUS __stdcall NtQueryFullAttributesFile(
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        _FILE_NETWORK_OPEN_INFORMATION *FileInformation){
  char PreviousMode; 
  __int64 v5; 
  _ETHREAD *CurrentThread; 
  _LOOKASIDE_LIST_EX *v7; 
  int v8; 
  NTSTATUS result; 
  UINT64 DesiredAccess; 
  PVOID Handle; 
  __int128 ParseContext[14]; 
  __int128 v13; 
  __int128 v14; 
  __int128 v15; 
  __int64 v16; 
  char v17[272]; 

  memset(v17, 0i64, sizeof(v17));
  Handle = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v5 = (__int64)FileInformation;
    if( ((unsigned __int8)FileInformation & 7) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)FileInformation >= 0x7FFFFFFF0000i64 )
      v5 = 0x7FFFFFFF0000i64;
    *(_BYTE *)v5 = *(_BYTE *)v5;
    *(_BYTE *)(v5 + 55) = *(_BYTE *)(v5 + 55);
  }
  memset(ParseContext, 0i64, 0xD8u);
  v13 = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  v16 = 0i64;
  LODWORD(ParseContext[0]) = 14155784;
  WORD3(ParseContext[4]) = 7;
  DWORD2(ParseContext[5]) = 1;
  LODWORD(ParseContext[4]) = 2113536;
  BYTE9(ParseContext[8]) = 1;
  BYTE11(ParseContext[8]) = 1;
  *(_QWORD *)&ParseContext[9] = v17;
  *(_QWORD *)&ParseContext[3] = ObjectAttributes;
  DWORD2(ParseContext[9]) = 32;
  if( PreviousMode )
    *((_QWORD *)&ParseContext[6] + 1) = &v13;
  else
    *((_QWORD *)&ParseContext[6] + 1) = FileInformation;
  memset(&ParseContext[10], 0, 40);
  LOWORD(ParseContext[10]) = 40;
  *(_QWORD *)&ParseContext[12] = PsGetCurrentSilo();
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  ++CurrentThread->Tcb.OtherOperationCount;
  __incgsdword(0x2EE4u);
  LODWORD(DesiredAccess) = 128;
  v8 = ObOpenObjectByNameEx(
         ObjectAttributes,
         (_OBJECT_TYPE *)IoFileObjectType,
         PreviousMode,
         0i64,
         DesiredAccess,
         ParseContext,
         *(_EJOB **)&ParseContext[12],
         &Handle);
  if( *((_QWORD *)&ParseContext[10] + 1) && FsRtlpCleanupEcps(*((_ECP_LIST **)&ParseContext[10] + 1), v7) )
    *((_QWORD *)&ParseContext[10] + 1) = 0i64;
  if( LODWORD(ParseContext[2]) == -1096154543 )
  {
    result = ParseContext[1];
    if( SLODWORD(ParseContext[1]) >= 0 )
    {
      if( PreviousMode )
      {
        *(_OWORD *)&FileInformation->CreationTime.anonymous_0.LowPart = v13;
        *(_OWORD *)&FileInformation->LastWriteTime.anonymous_0.LowPart = v14;
        *(_OWORD *)&FileInformation->AllocationSize.anonymous_0.LowPart = v15;
        *(_QWORD *)&FileInformation->FileAttributes = v16;
      }
    }
  }
  else
  {
    if( v8 >= 0 )
    {
      ObCloseHandle(Handle, PreviousMode);
      return -1073741788;
    }
    return v8;
  }
  return result;
}

Referenced by: