ExpGetSystemWriteConstraintInformation

INT64 __fastcall ExpGetSystemWriteConstraintInformation(_QWORD *a1){
  NTSTATUS v2; 
  NTSTATUS Status; 
  UINT64 FileAttributes; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  _OBJECT_ATTRIBUTES v12; 
  HANDLE FileHandle; 
  void *EventHandle; 
  __int64 OutputBuffer; 
  FileHandle = 0i64;
  EventHandle = 0i64;
  *(_QWORD *)&v12.Length = 48i64;
  v12.RootDirectory = 0i64;
  v12.ObjectName = (_UNICODE_STRING *)L"*,";
  *(_QWORD *)&v12.Attributes = 576i64;
  *(_OWORD *)&v12.SecurityDescriptor = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  IoStatusBlock = 0i64;
  OutputBuffer = 0i64;
  LODWORD(EaLength) = 0;
  LODWORD(CreateOptions) = 32;
  LODWORD(CreateDisposition) = 1;
  LODWORD(ShareAccess) = 0;
  LODWORD(FileAttributes) = 128;
  v2 = ZwCreateFile(
         &FileHandle,
         0x100000ui64,
         &v12,
         &IoStatusBlock,
         0i64,
         FileAttributes,
         ShareAccess,
         CreateDisposition,
         CreateOptions,
         0i64,
         EaLength);
  Status = v2;
  if( v2 == -1073741772 )
  {
    Status = 0;
  }
  else if( v2 >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    Status = ZwCreateEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes, SynchronizationEvent, 0);
    if( Status >= 0 )
    {
      Status = ZwDeviceIoControlFile(
                 FileHandle,
                 EventHandle,
                 0i64,
                 0i64,
                 &IoStatusBlock,
                 0x220A0Cu,
                 0i64,
                 0,
                 &OutputBuffer,
                 8u);
      if( Status >= 0 )
        Status = IoStatusBlock.Status;
    }
  }
  if( FileHandle )
    ZwClose(FileHandle);
  if( EventHandle )
    ZwClose(EventHandle);
  *a1 = OutputBuffer;
  return(unsigned int)Status;
}

Referenced by: