signed int __stdcall DeviceControlIRP(int a1, PIRP Irp)
{
  int subFileAttributes; // eax@1
  PIRP v3; // ebx@1
  void *v4; // edi@1
  PIO_SECURITY_CONTEXT pIO_SECURITY_CONTEXT; // esi@1
  PIO_STACK_LOCATION pStack; // eax@1
  int v7; // eax@2
  int v8; // eax@3
  signed int v10; // [sp+Ch] [bp-4h]@1
  struct _IO_SECURITY_CONTEXT *pIO_SECURITY_CONTEXT_v11; // [sp+1Ch] [bp+Ch]@1

  v3 = Irp;
  pStack = (PIO_STACK_LOCATION)Irp->Tail.Overlay.CurrentStackLocation;
  pIO_SECURITY_CONTEXT = pStack->Parameters.Create.SecurityContext;
  subFileAttributes = *(_DWORD *)&pStack->Parameters.Create.FileAttributes - 0x222000;
  v4 = Irp->AssociatedIrp.MasterIrp;
  v10 = 0xC0000010u;
  pIO_SECURITY_CONTEXT_v11 = pIO_SECURITY_CONTEXT;
  if ( !subFileAttributes )
    goto LABEL_11;
  v7 = subFileAttributes - 4;
  if ( !v7 )
  {
    *((_DWORD *)v4 + 521) = dispatch_io_device(*(_DWORD *)v4, v4);
    goto LABEL_11;
  }
  v8 = v7 - 4;
  if ( !v8 )
  {
LABEL_11:
    v10 = 0;
    v3->IoStatus.Information = (ULONG)pIO_SECURITY_CONTEXT;
    goto IofCompleteRequesT;
  }
  if ( v8 == 4 )
  {
    if ( (unsigned int)pIO_SECURITY_CONTEXT < 0x18 )
      goto LABEL_6;
    memcpy(v4, "Hello World from Driver", 0x18u);
    pIO_SECURITY_CONTEXT = pIO_SECURITY_CONTEXT_v11;
    v3->IoStatus.Information = 24;
    goto LABEL_11;
  }
  v10 = 0xC000000Du;
LABEL_6:
  v3->IoStatus.Information = 0;
IofCompleteRequesT:
  v3->IoStatus.Status = v10;
  IofCompleteRequest(v3, 0);
  return v10;
}

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法