CmpOpenFileWithExtremePrejudice
NTSTATUS __fastcall CmpOpenFileWithExtremePrejudice(
VOID **FileHandle,
_OBJECT_ATTRIBUTES *ObjectAttributes,
_IO_STATUS_BLOCK *IoStatusBlock,
UINT64 FileAttributes,
UINT64 a5){
int v7;
NTSTATUS result;
NTSTATUS v10;
UINT64 ShareAccess;
UINT64 ShareAccessa;
UINT64 OpenOptions;
UINT64 OpenOptionsa;
UINT64 v15;
UINT64 CreateDisposition;
UINT64 CreateOptions;
UINT64 v18;
VOID *FileHandlea;
_IO_STATUS_BLOCK IoStatusBlocka;
_FILE_BASIC_INFORMATION FileInformation;
FileHandlea = 0i64;
*FileHandle = 0i64;
v7 = FileAttributes;
IoStatusBlocka = 0i64;
memset(&FileInformation, 0, sizeof(FileInformation));
result = ZwQueryAttributesFile(ObjectAttributes, &FileInformation);
if( result >= 0 )
{
FileInformation.FileAttributes &= ~1u;
LODWORD(OpenOptions) = 0x4000;
LODWORD(ShareAccess) = 7;
result = ZwOpenFile(&FileHandlea, 0x100ui64, ObjectAttributes, &IoStatusBlocka, ShareAccess, OpenOptions);
if( result >= 0 )
{
LODWORD(ShareAccessa) = 4;
v10 = ZwSetInformationFile(
(UINT64)FileHandlea,
(UINT64)&IoStatusBlocka,
(INT8 *)&FileInformation,
0x28ui64,
ShareAccessa);
ZwClose((_HANDLE)FileHandlea);
if( v10 >= 0 )
{
LODWORD(v18) = 0;
LODWORD(CreateOptions) = a5;
LODWORD(CreateDisposition) = 1;
LODWORD(v15) = 0;
LODWORD(OpenOptionsa) = v7;
return ZwCreateFile(
FileHandle,
3ui64,
ObjectAttributes,
IoStatusBlock,
0i64,
OpenOptionsa,
v15,
CreateDisposition,
CreateOptions,
0i64,
v18);
}
else
{
return v10;
}
}
}
return result;
}Referenced by:
CmpOpenHiveFile