VrpCreateNamespaceNodePlaceholderKey
INT64 __fastcall VrpCreateNamespaceNodePlaceholderKey(INT64 a1){
NTSTATUS v2;
UINT64 CreateOptions;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
UINT64 Disposition;
void *KeyHandle;
LODWORD(Disposition) = 0;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
KeyHandle = 0i64;
if( *(_WORD *)(a1 + 40) )
{
ObjectAttributes.ObjectName = (_UNICODE_STRING *)(a1 + 40);
ObjectAttributes.Length = 48;
LODWORD(CreateOptions) = 0;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v2 = ZwCreateKey(&KeyHandle, 0xF003Fui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, &Disposition);
if( v2 >= 0 && (_DWORD)Disposition == 1 )
*(_DWORD *)(a1 + 56) |= 0x40000000u;
if( KeyHandle )
ZwClose(KeyHandle);
}
else
{
return 0;
}
return(unsigned int)v2;
}Referenced by:
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpPreLoadKey