NtQueryAttributesFile

NTSTATUS __stdcall NtQueryAttributesFile(
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        _FILE_BASIC_INFORMATION *FileInformation){
  char PreviousMode; 
  __int64 v5; 
  _ETHREAD *CurrentThread; 
  _LOOKASIDE_LIST_EX *v7; 
  int v8; 
  UINT64 DesiredAccess; 
  PVOID Handle; 
  __int128 ParseContext[14]; 
  __int128 v13[3]; 
  __int64 v14; 
  char v15[272]; 

  memset(v15, 0i64, sizeof(v15));
  Handle = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v5 = (__int64)FileInformation;
    if( ((unsigned __int8)FileInformation & 7) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)FileInformation >= 0x7FFFFFFF0000i64 )
      v5 = 0x7FFFFFFF0000i64;
    *(_BYTE *)v5 = *(_BYTE *)v5;
    *(_BYTE *)(v5 + 39) = *(_BYTE *)(v5 + 39);
  }
  memset(ParseContext, 0i64, 0xD8u);
  memset(v13, 0, sizeof(v13));
  v14 = 0i64;
  LODWORD(ParseContext[0]) = 14155784;
  WORD3(ParseContext[4]) = 7;
  DWORD2(ParseContext[5]) = 1;
  LODWORD(ParseContext[4]) = 2113536;
  *(_QWORD *)&ParseContext[6] = FileInformation;
  *((_QWORD *)&ParseContext[6] + 1) = v13;
  BYTE9(ParseContext[8]) = 1;
  *(_QWORD *)&ParseContext[9] = v15;
  *(_QWORD *)&ParseContext[3] = ObjectAttributes;
  DWORD2(ParseContext[9]) = 32;
  memset(&ParseContext[10], 0, 40);
  LOWORD(ParseContext[10]) = 40;
  *(_QWORD *)&ParseContext[12] = PsGetCurrentSilo();
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  ++CurrentThread->Tcb.OtherOperationCount;
  __incgsdword(0x2EE4u);
  LODWORD(DesiredAccess) = 128;
  v8 = ObOpenObjectByNameEx(
         ObjectAttributes,
         (_OBJECT_TYPE *)IoFileObjectType,
         PreviousMode,
         0i64,
         DesiredAccess,
         ParseContext,
         *(_EJOB **)&ParseContext[12],
         &Handle);
  if( *((_QWORD *)&ParseContext[10] + 1) && FsRtlpCleanupEcps(*((_ECP_LIST **)&ParseContext[10] + 1), v7) )
    *((_QWORD *)&ParseContext[10] + 1) = 0i64;
  if( LODWORD(ParseContext[2]) == -1096154543 )
    return ParseContext[1];
  if( v8 >= 0 )
  {
    ObCloseHandle(Handle, PreviousMode);
    return -1073741788;
  }
  return v8;
}

Referenced by: