ObCreateSymbolicLink

NTSTATUS __stdcall ObCreateSymbolicLink(
        _XSTATE_CONFIGURATION *a1,
        UINT64 a2,
        EVT_WDFCX_DEVICE_PRE_SELF_MANAGED_IO_SUSPEND *a3,
        _XSTATE_CONFIGURATION *a4,
        CHAR PreviousMode){
  _XSTATE_CONFIGURATION *v5; 
  unsigned int v6; 
  _XSTATE_CONFIGURATION *v7; 
  int inserted; 
  _DWORD *v9; 
  VOID **PoolWithTag; 
  VOID *v12; 
  VOID *v13; 
  UINT64 ObjectBodySize; 
  PVOID *Handle; 
  UINT64 v16; 
  PVOID Object; 
  PVOID v18; 

  v5 = a4;
  v6 = a2;
  v7 = a1;
  v18 = 0i64;
  Object = 0i64;
  LODWORD(v16) = 0;
  LODWORD(Handle) = 0;
  LODWORD(ObjectBodySize) = 40;
  LOBYTE(a4) = PreviousMode;
  LOBYTE(a1) = PreviousMode;
  inserted = ObCreateObjectEx(
               (UINT64)a1,
               ObjectType,
               (_OBJECT_ATTRIBUTES *)a3,
               (UINT64)a4,
               v12,
               ObjectBodySize,
               (UINT64)Handle,
               v16,
               &Object,
               0i64);
  if( inserted < 0 )
  {
    v9 = Object;
  }
  else
  {
    v9 = Object;
    *(_QWORD *)Object = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    v9[6] = 0;
    v9[7] = 0;
    if( (v5->EnabledFeatures & 1) != 0 )
    {
      v9[7] = 16;
      *((_QWORD *)v9 + 1) = v5->EnabledVolatileFeatures;
      *((_QWORD *)v9 + 2) = *(_QWORD *)&v5->Size;
    }
    else
    {
      *((_WORD *)v9 + 5) = WORD1(v5->EnabledVolatileFeatures);
      *((_WORD *)v9 + 4) = v5->EnabledVolatileFeatures;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, WORD1(v5->EnabledVolatileFeatures), 1953331539i64);
      *((_QWORD *)v9 + 2) = PoolWithTag;
      if( !PoolWithTag )
      {
        inserted = -1073741801;
        goto LABEL_9;
      }
      memmove(PoolWithTag, *(const VOID **)&v5->Size, WORD1(v5->EnabledVolatileFeatures));
    }
    if( (unsigned __int8)RtlIsSandboxedToken(InterruptControllerInvalid) )
      v9[7] |= 2u;
    LODWORD(v13) = 0;
    inserted = ObInsertObjectEx(v9, 0i64, v6, 0i64, (UINT64)v13, 0i64, &v18);
    v9 = 0i64;
    Object = 0i64;
    if( inserted >= 0 )
    {
      v7->EnabledFeatures = (unsigned __int64)v18;
      inserted = 0;
    }
  }
LABEL_9:
  if( v9 )
    HalPutDmaAdapter((PADAPTER_OBJECT)v9);
  return inserted;
}

Referenced by: