NtCreateSymbolicLinkObject

NTSTATUS __stdcall NtCreateSymbolicLinkObject(
        VOID **LinkHandle,
        _ACCESS_MASK DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        _UNICODE_STRING *LinkTarget){
  char PreviousMode; 
  _UNICODE_STRING v9; 
  _UNICODE_STRING *v10; 
  unsigned __int16 v11; 
  int SymbolicLink; 
  REGHANDLE v13; 
  unsigned int v14; 
  __int64 v15; 
  unsigned int v16; 
  __int64 v17; 
  __int64 v18; 
  unsigned int v19; 
  __int64 v20; 
  __int64 v21; 
  unsigned __int16 v23; 
  wchar_t *v24; 
  wchar_t *v25; 
  __int64 v26; 
  __int16 v27; 
  _UNICODE_STRING v28; 
  _ACCESS_MASK v29; 
  int v30; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING *ObjectName; 
  __int64 v33; 
  _UNICODE_STRING v34; 
  _EVENT_DATA_DESCRIPTOR UserData[6]; 

  v28 = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  RtlInitUnicodeString(&v28, 0i64);
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    if( ((unsigned __int8)ObjectAttributes & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    ObjectName = ObjectAttributes->ObjectName;
    if( ObjectName )
    {
      DestinationString = *ObjectName;
      v23 = _mm_cvtsi128_si32((__m128i)DestinationString);
      if( v23 )
      {
        v24 = (wchar_t *)((char *)DestinationString.Buffer + v23);
        if( (unsigned __int64)v24 > 0x7FFFFFFF0000i64 || v24 < DestinationString.Buffer )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    v28 = *LinkTarget;
    if( v28.MaximumLength )
    {
      v25 = (wchar_t *)((char *)v28.Buffer + v28.MaximumLength);
      if( (unsigned __int64)v25 > 0x7FFFFFFF0000i64 || v25 < v28.Buffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    v26 = (__int64)LinkHandle;
    if( (unsigned __int64)LinkHandle >= 0x7FFFFFFF0000i64 )
      v26 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v26 = *(_QWORD *)v26;
    v9 = v28;
  }
  else
  {
    v9 = *LinkTarget;
    v28 = *LinkTarget;
    v10 = ObjectAttributes->ObjectName;
    if( v10 )
      DestinationString = *v10;
  }
  if( (v9.MaximumLength & 1) != 0 )
  {
    v28.MaximumLength = v9.MaximumLength & 0xFFFE;
    v9 = v28;
  }
  if( !v28.MaximumLength )
    return -1073741811;
  v11 = _mm_cvtsi128_si32((__m128i)v9);
  if( v11 > v28.MaximumLength || (_mm_cvtsi128_si32((__m128i)v9) & 1) != 0 )
    return -1073741811;
  v33 = 0i64;
  v34 = v9;
  SymbolicLink = ObCreateSymbolicLink(
                   (_XSTATE_CONFIGURATION *)LinkHandle,
                   (unsigned int)DesiredAccess,
                   (EVT_WDFCX_DEVICE_PRE_SELF_MANAGED_IO_SUSPEND *)ObjectAttributes,
                   (_XSTATE_CONFIGURATION *)&v33,
                   PreviousMode);
  v30 = SymbolicLink;
  v29 = DesiredAccess;
  v13 = *(&ExBootDevicesRemovedEvent + 379);
  if( *(&ExBootDevicesRemovedEvent + 379) )
  {
    v27 = 0;
    v14 = 0;
    if( DestinationString.Buffer )
    {
      UserData[0].Ptr = (unsigned __int64)DestinationString.Buffer;
      UserData[0].Size = DestinationString.Length;
      UserData[0].Reserved = 0;
      v14 = 1;
    }
    v15 = v14;
    UserData[v15].Ptr = (unsigned __int64)&v27;
    *(_QWORD *)&UserData[v15].Size = 2i64;
    v16 = v14 + 1;
    if( v28.Buffer )
    {
      v17 = v16;
      UserData[v17].Ptr = (unsigned __int64)v28.Buffer;
      UserData[v17].Size = v11;
      UserData[v17].Reserved = 0;
      ++v16;
    }
    v18 = v16;
    UserData[v18].Ptr = (unsigned __int64)&v27;
    *(_QWORD *)&UserData[v18].Size = 2i64;
    v19 = v16 + 1;
    v20 = v19;
    UserData[v20].Ptr = (unsigned __int64)&v29;
    *(_QWORD *)&UserData[v20].Size = 4i64;
    v21 = ++v19;
    UserData[v21].Ptr = (unsigned __int64)&v30;
    *(_QWORD *)&UserData[v21].Size = 4i64;
    EtwWrite(v13, &KERNEL_AUDIT_API_CREATESYMBOLICLINKOBJECT, 0, v19 + 1, UserData);
  }
  return SymbolicLink;
}

Referenced by: