XpressMaximumCompressBuffer

ULONG XpressMaximumCompressBuffer(_In_ PBYTE UncompressedBuffer, _In_ ULONG SizeOfUncompressedBufferInBytes, _Inout_ PBYTE CompressedBuffer, _In_ ULONG CompressedBufferSizeInBytes)
{
	typedef NTSTATUS(NTAPI* RTLCOMPRESSBUFFER)(USHORT, PUCHAR, ULONG, PUCHAR, ULONG, ULONG, PULONG, PVOID);
	typedef NTSTATUS(NTAPI* RTLGETCOMPRESSIONWORKSPACESIZE)(USHORT, PULONG, PULONG);
	RTLCOMPRESSBUFFER RtlCompressBuffer = NULL;
	RTLGETCOMPRESSIONWORKSPACESIZE RtlGetCompressionWorkSpaceSize = NULL;
	HMODULE hMod = NULL;
	NTSTATUS Status = STATUS_SUCCESS;
	USHORT CompressionFormatAndEngine = COMPRESSION_FORMAT_XPRESS | COMPRESSION_ENGINE_MAXIMUM;
	ULONG CompressBufferWorkSpaceSize = 0;
	ULONG CompressFragmentWorkSpaceSize = 0;
	PVOID Workspace = NULL;
	ULONG FinalCompressedSize = 0;

	hMod = GetModuleHandleW(L"ntdll.dll");
	if (hMod == NULL)
		goto EXIT_ROUTINE;

	RtlCompressBuffer = (RTLCOMPRESSBUFFER)GetProcAddress(hMod, "RtlCompressBuffer");
	RtlGetCompressionWorkSpaceSize = (RTLGETCOMPRESSIONWORKSPACESIZE)GetProcAddress(hMod, "RtlGetCompressionWorkSpaceSize");

	if (!RtlCompressBuffer || !RtlGetCompressionWorkSpaceSize)
		goto EXIT_ROUTINE;

	Status = RtlGetCompressionWorkSpaceSize(CompressionFormatAndEngine, &CompressBufferWorkSpaceSize, &CompressFragmentWorkSpaceSize);
	if (Status != STATUS_SUCCESS)
		goto EXIT_ROUTINE;

	if (CompressBufferWorkSpaceSize == 0)
		goto EXIT_ROUTINE;

	Workspace = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, CompressBufferWorkSpaceSize);
	if (Workspace == NULL)
		goto EXIT_ROUTINE;

	Status = RtlCompressBuffer(CompressionFormatAndEngine, UncompressedBuffer, SizeOfUncompressedBufferInBytes, CompressedBuffer, CompressedBufferSizeInBytes, 4096, &FinalCompressedSize, Workspace);
	if (Status != STATUS_SUCCESS)
		goto EXIT_ROUTINE;

EXIT_ROUTINE:

	if (Workspace)
		HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, Workspace);

	return FinalCompressedSize;
}