NtDeleteFile

NTSTATUS __fastcall NtDeleteFile(INT64 a1){
  char PreviousMode; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v4; 
  _ECP_LIST *v5; 
  NTSTATUS result; 
  UINT64 DesiredAccess; 
  PVOID Handle; 
  _OPEN_PACKET OpenPacket; 
  char v10[272]; 

  memset(v10, 0i64, sizeof(v10));
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  memset(&OpenPacket, 0i64, sizeof(OpenPacket));
  *(_DWORD *)&OpenPacket.Type = 14155784;
  OpenPacket.CreateOptions = 4096;
  OpenPacket.ShareAccess = 7;
  OpenPacket.LocalFileObject = (_DUMMY_FILE_OBJECT *)v10;
  memset(&OpenPacket.DriverCreateContext, 0, sizeof(OpenPacket.DriverCreateContext));
  OpenPacket.DriverCreateContext.Size = 40;
  OpenPacket.Disposition = 1;
  OpenPacket.DeleteOnly = 1;
  OpenPacket.OriginalAttributes = (_OBJECT_ATTRIBUTES *)a1;
  OpenPacket.InternalFlags = 32;
  OpenPacket.DriverCreateContext.SiloContext = PsGetCurrentSilo();
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  ++CurrentThread->Tcb.OtherOperationCount;
  __incgsdword(0x2EE4u);
  LODWORD(DesiredAccess) = 0x10000;
  v4 = ObOpenObjectByNameEx(
         (_OBJECT_ATTRIBUTES *)a1,
         (_OBJECT_TYPE *)IoFileObjectType,
         PreviousMode,
         0i64,
         DesiredAccess,
         &OpenPacket,
         OpenPacket.DriverCreateContext.SiloContext,
         &Handle);
  IopCleanupExtraCreateParameters(&OpenPacket, v5);
  result = OpenPacket.FinalStatus;
  if( OpenPacket.ParseCheck != -1096154543 )
    return v4;
  return result;
}

Referenced by: