EtwpCreateDirectoryFile

NTSTATUS __stdcall EtwpCreateDirectoryFile(
        WCHAR *DirFileName,
        UINT8 IsDirectory,
        UINT8 NoIntermediate,
        UINT8 RealTime,
        VOID **FileHandle,
        _IO_STATUS_BLOCK *IoStatus,
        UINT64 Append){
  UINT64 v10; 
  int v11; 
  int v12; 
  int v13; 
  UINT64 FileAttributes; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  VOID *Handle; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  Handle = 0i64;
  DestinationString = 0i64;
  if( !IsDirectory && !FileHandle )
    return -1073741811;
  RtlInitUnicodeString(&DestinationString, DirFileName);
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Attributes = RealTime != 0 ? 576 : 1600;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( IsDirectory )
  {
    v12 = 3;
    v10 = 1180063i64;
    v11 = 33;
  }
  else
  {
    v10 = RealTime != 0 ? 1245323 : 1179787;
    v11 = NoIntermediate != 0 ? 40 : 32;
    v12 = (_DWORD)Append != 0 ? 3 : 5;
  }
  LODWORD(EaLength) = 0;
  LODWORD(CreateOptions) = v11;
  LODWORD(CreateDisposition) = v12;
  LODWORD(ShareAccess) = 5;
  LODWORD(FileAttributes) = 128;
  v13 = ZwCreateFile(
          &Handle,
          v10,
          &ObjectAttributes,
          IoStatus,
          0i64,
          FileAttributes,
          ShareAccess,
          CreateDisposition,
          CreateOptions,
          0i64,
          EaLength);
  if( v13 >= 0 && IsDirectory && Handle )
  {
    ZwClose((_HANDLE)Handle);
    if( FileHandle )
      *FileHandle = 0i64;
  }
  else if( FileHandle )
  {
    *FileHandle = Handle;
  }
  if( IsDirectory == 1 && v13 == -1073741757 )
    return 0;
  return v13;
}

Referenced by: