NtCreateSymbolicLinkObject

NTSTATUS __stdcall NtCreateSymbolicLinkObject(
        PVOID *LinkHandle,
        UINT64 DesiredAccess,
        OBJECT_ATTRIBUTES *ObjectAttributes,
        UNICODE_STRING *LinkTarget){
  unsigned int v6; 
  WCHAR v8; 
  INT8 v9; 
  struct _UNICODE_STRING v10; 
  struct _UNICODE_STRING *v11; 
  unsigned __int16 v12; 
  NTSTATUS SymbolicLink; 
  UINT64 v14; 
  unsigned int v15; 
  __int64 v16; 
  unsigned int v17; 
  __int64 v18; 
  __int64 v19; 
  unsigned int v20; 
  __int64 v21; 
  __int64 v22; 
  unsigned __int16 v24; 
  wchar_t *v25; 
  wchar_t *v26; 
  __int64 v27; 
  __int16 v28; 
  struct _UNICODE_STRING v29; 
  unsigned int v30; 
  NTSTATUS v31; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING *ObjectName; 
  INT64 a4; 
  struct _UNICODE_STRING v35; 
  EVENT_DATA_DESCRIPTOR UserData[6]; 
  v6 = DesiredAccess;
  v29 = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64, (WCHAR)ObjectAttributes);
  RtlInitUnicodeString(&v29, 0i64, v8);
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v9 )
  {
    if( ((unsigned __int8)ObjectAttributes & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    ObjectName = ObjectAttributes->ObjectName;
    if( ObjectName )
    {
      DestinationString = *ObjectName;
      v24 = _mm_cvtsi128_si32((__m128i)DestinationString);
      if( v24 )
      {
        v25 = (wchar_t *)((char *)DestinationString.Buffer + v24);
        if( (unsigned __int64)v25 > 0x7FFFFFFF0000i64 || v25 < DestinationString.Buffer )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    v29 = *LinkTarget;
    if( v29.MaximumLength )
    {
      v26 = (wchar_t *)((char *)v29.Buffer + v29.MaximumLength);
      if( (unsigned __int64)v26 > 0x7FFFFFFF0000i64 || v26 < v29.Buffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    v27 = (__int64)LinkHandle;
    if( (unsigned __int64)LinkHandle >= 0x7FFFFFFF0000i64 )
      v27 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v27 = *(_QWORD *)v27;
    v10 = v29;
  }
  else
  {
    v10 = *LinkTarget;
    v29 = *LinkTarget;
    v11 = ObjectAttributes->ObjectName;
    if( v11 )
      DestinationString = *v11;
  }
  if( (v10.MaximumLength & 1) != 0 )
  {
    v29.MaximumLength = v10.MaximumLength & 0xFFFE;
    v10 = v29;
  }
  if( !v29.MaximumLength )
    return -1073741811;
  v12 = _mm_cvtsi128_si32((__m128i)v10);
  if( v12 > v29.MaximumLength || (_mm_cvtsi128_si32((__m128i)v10) & 1) != 0 )
    return -1073741811;
  a4 = 0i64;
  v35 = v10;
  SymbolicLink = ObCreateSymbolicLink(LinkHandle, v6, (INT64)ObjectAttributes, (INT64)&a4, v9);
  v31 = SymbolicLink;
  v30 = v6;
  v14 = EtwApiCallsProvRegHandle;
  if( EtwApiCallsProvRegHandle )
  {
    v28 = 0;
    v15 = 0;
    if( DestinationString.Buffer )
    {
      UserData[0].Ptr = (unsigned __int64)DestinationString.Buffer;
      UserData[0].Size = DestinationString.Length;
      UserData[0].Reserved = 0;
      v15 = 1;
    }
    v16 = v15;
    UserData[v16].Ptr = (unsigned __int64)&v28;
    *(_QWORD *)&UserData[v16].Size = 2i64;
    v17 = v15 + 1;
    if( v29.Buffer )
    {
      v18 = v17;
      UserData[v18].Ptr = (unsigned __int64)v29.Buffer;
      UserData[v18].Size = v12;
      UserData[v18].Reserved = 0;
      ++v17;
    }
    v19 = v17;
    UserData[v19].Ptr = (unsigned __int64)&v28;
    *(_QWORD *)&UserData[v19].Size = 2i64;
    v20 = v17 + 1;
    v21 = v20;
    UserData[v21].Ptr = (unsigned __int64)&v30;
    *(_QWORD *)&UserData[v21].Size = 4i64;
    v22 = ++v20;
    UserData[v22].Ptr = (unsigned __int64)&v31;
    *(_QWORD *)&UserData[v22].Size = 4i64;
    EtwWrite(v14, (EVENT_DESCRIPTOR *)&KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT, 0i64, v20 + 1, UserData);
  }
  return SymbolicLink;
}

Referenced by: