RtlCreateSystemVolumeInformationFolder

NTSTATUS __stdcall RtlCreateSystemVolumeInformationFolder(UNICODE_STRING *VolumeRootPath){
  WCHAR v1; 
  unsigned int Length; 
  UINT64 v4; 
  unsigned __int16 v5; 
  wchar_t v6; 
  UINT64 v7; 
  void *PoolWithTag; 
  unsigned __int64 v9; 
  NTSTATUS v10; 
  PVOID v11; 
  PVOID v12; 
  UINT64 FileAttributes; 
  UINT64 FileAttributesa; 
  UINT64 FileAttributesb; 
  UINT64 ShareAccess; 
  UINT64 ShareAccessa; 
  UINT64 ShareAccessb; 
  UINT64 CreateDisposition; 
  UINT64 CreateDispositiona; 
  UINT64 CreateDispositionb; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 CreateOptionsb; 
  UINT64 EaLength; 
  UINT64 EaLengtha; 
  UINT64 EaLengthb; 
  PVOID P[2]; 
  struct _UNICODE_STRING DestinationString; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *FileHandle; 
  PVOID v34; 
  PVOID SecurityDescriptor; 
  SecurityDescriptor = 0i64;
  v34 = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DestinationString = 0i64;
  FileHandle = 0i64;
  *(_OWORD *)P = 0i64;
  IoStatusBlock = 0i64;
  RtlInitUnicodeString(&DestinationString, L"System Volume Information", v1);
  Length = VolumeRootPath->Length;
  v4 = DestinationString.Length;
  v5 = DestinationString.Length + Length;
  LOWORD(P[0]) = DestinationString.Length + Length;
  if( (unsigned __int16)(DestinationString.Length + Length) < (unsigned __int16)Length || v5 < DestinationString.Length )
    return -1073741811;
  v6 = VolumeRootPath->Buffer[((unsigned __int64)Length >> 1) - 1];
  if( v6 != 92 )
  {
    v5 += 2;
    LOWORD(P[0]) = v5;
  }
  v7 = (unsigned __int16)(v5 + 2);
  WORD1(P[0]) = v7;
  PoolWithTag = ExAllocatePoolWithTag(PagedPool, v7, 0x536C6F56ui64);
  P[1] = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove((UINT8 *)PoolWithTag, (UINT8 *)VolumeRootPath->Buffer, VolumeRootPath->Length);
  v9 = VolumeRootPath->Length;
  LOWORD(P[0]) = VolumeRootPath->Length;
  if( v6 != 92 )
  {
    *((_WORD *)P[1] + (v9 >> 1)) = 92;
    LOWORD(v9) = LOWORD(P[0]) + 2;
    LOWORD(P[0]) += 2;
  }
  memmove((UINT8 *)P[1] + (unsigned __int16)v9, (UINT8 *)DestinationString.Buffer, v4);
  LOWORD(P[0]) += v4;
  *((_WORD *)P[1] + ((unsigned __int64)LOWORD(P[0]) >> 1)) = 0;
  v10 = RtlpSysVolCreateSecurityDescriptor(&SecurityDescriptor, (ACL **)&v34);
  if( v10 < 0 )
  {
    v12 = P[1];
  }
  else
  {
    v11 = SecurityDescriptor;
    LODWORD(EaLength) = 0;
    LODWORD(CreateOptions) = 2101344;
    LODWORD(CreateDisposition) = 1;
    LODWORD(ShareAccess) = 7;
    LODWORD(FileAttributes) = 0;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)P;
    ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
    ObjectAttributes.SecurityQualityOfService = 0i64;
    if( NtCreateFile(
           &FileHandle,
           0x10000ui64,
           &ObjectAttributes,
           &IoStatusBlock,
           0i64,
           FileAttributes,
           ShareAccess,
           CreateDisposition,
           CreateOptions,
           0i64,
           EaLength) >= 0 )
      NtClose(FileHandle);
    LODWORD(EaLengtha) = 0;
    LODWORD(CreateOptionsa) = 33;
    LODWORD(CreateDispositiona) = 3;
    LODWORD(ShareAccessa) = 7;
    LODWORD(FileAttributesa) = 6;
    v10 = NtCreateFile(
            &FileHandle,
            0x1E0000ui64,
            &ObjectAttributes,
            &IoStatusBlock,
            0i64,
            FileAttributesa,
            ShareAccessa,
            CreateDispositiona,
            CreateOptionsa,
            0i64,
            EaLengtha);
    if( v10 < 0 )
    {
      RtlpSysVolTakeOwnership((UNICODE_STRING *)P);
      LODWORD(EaLengthb) = 0;
      LODWORD(CreateOptionsb) = 33;
      LODWORD(CreateDispositionb) = 3;
      LODWORD(ShareAccessb) = 7;
      LODWORD(FileAttributesb) = 6;
      v10 = NtCreateFile(
              &FileHandle,
              0x1E0000ui64,
              &ObjectAttributes,
              &IoStatusBlock,
              0i64,
              FileAttributesb,
              ShareAccessb,
              CreateDispositionb,
              CreateOptionsb,
              0i64,
              EaLengthb);
    }
    ExFreePoolWithTag(P[1], 0);
    if( v10 < 0 )
    {
      ExFreePoolWithTag(v34, 0);
      v12 = v11;
    }
    else
    {
      ExFreePoolWithTag(v11, 0);
      v10 = RtlpSysVolCheckOwnerAndSecurity(FileHandle, (_ACL *)v34);
      NtClose(FileHandle);
      v12 = v34;
    }
  }
  ExFreePoolWithTag(v12, 0);
  return v10;
}

Referenced by: