in PPLGuard/utils.cpp [391:412]
HANDLE ObjectManagerCreateSymlink(LPCWSTR linkname, LPCWSTR targetname)
{
OBJECT_ATTRIBUTES oa = { 0 };
UNICODE_STRING name = { 0 };
UNICODE_STRING target = { 0 };
HANDLE hLink = NULL;
NTSTATUS status = 0;
RtlInitUnicodeString(&name, linkname);
RtlInitUnicodeString(&target, targetname);
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);
status = NtCreateSymbolicLinkObject(&hLink, SYMBOLIC_LINK_ALL_ACCESS, &oa, &target);
SetLastError(RtlNtStatusToDosError(status));
if (status != 0)
{
PrintLastError(L"NtCreateSymbolicLinkObject");
return NULL;
}
return hLink;
}