IopReassignSystemRoot

UINT8 __stdcall IopReassignSystemRoot(_LOADER_PARAMETER_BLOCK *LoaderBlock, _STRING *NtDeviceName){
  WCHAR v3; 
  int v4; 
  NTSTATUS v5; 
  NTSTATUS v6; 
  WCHAR v8; 
  void *SymbolicLinkHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _UNICODE_STRING v12; 
  wchar_t pszDest[256]; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  SymbolicLinkHandle = 0i64;
  v12 = 0i64;
  DestinationString = 0i64;
  RtlStringCchPrintfW(pszDest, 0x100ui64, (WCHAR *)L"\\ArcName\\%S");
  if( v4 < 0 )
    return 0;
  RtlInitUnicodeString(&DestinationString, pszDest, v3);
  DestinationString.MaximumLength = 512;
  while( 1 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v5 = NtOpenSymbolicLinkObject(&SymbolicLinkHandle, 0xF0001ui64, &ObjectAttributes);
    if( v5 == -1073741788 )
      break;
    if( v5 >= 0 )
    {
      DestinationString.Length = 0;
      v6 = NtQuerySymbolicLinkObject(SymbolicLinkHandle, &DestinationString, 0i64);
      ObCloseHandle(SymbolicLinkHandle, 0);
      if( v6 >= 0 )
        continue;
    }
    return 0;
  }
  if( RtlUnicodeStringToAnsiString(NtDeviceName, &DestinationString, 0) < 0 )
    return 0;
  RtlInitUnicodeString(&v12, L"\\Device\\BootDevice", v8);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &v12;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( NtOpenSymbolicLinkObject(&SymbolicLinkHandle, 0xF0001ui64, &ObjectAttributes) < 0 )
    return 0;
  NtMakeTemporaryObject(SymbolicLinkHandle);
  ObCloseHandle(SymbolicLinkHandle, 0);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &v12;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 592;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  NtCreateSymbolicLinkObject(&SymbolicLinkHandle, 0xF0001ui64, &ObjectAttributes, &DestinationString);
  ObCloseHandle(SymbolicLinkHandle, 0);
  return 1;
}

Referenced by: