ObReferenceObjectByNameEx

NTSTATUS __stdcall ObReferenceObjectByNameEx(
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        UINT64 DesiredAccess,
        _OBJECT_TYPE *ObjectType,
        CHAR AccessMode,
        VOID *ParseContext,
        VOID **Object){
  _OBJECT_TYPE *v6; 
  unsigned int v7; 
  struct _KPRCB *CurrentPrcb; 
  _GENERAL_LOOKASIDE *P; 
  PSLIST_ENTRY v12; 
  unsigned int Number; 
  _SLIST_ENTRY *v14; 
  _EJOB *Silo; 
  __int64 v16; 
  INT64 *v17; 
  CHAR v18; 
  _SLIST_ENTRY *Next; 
  struct _KPRCB *v20; 
  _GENERAL_LOOKASIDE *v21; 
  _GENERAL_LOOKASIDE *L; 
  __int64 Size; 
  void *(__fastcall *AllocateEx)(_POOL_TYPE, unsigned __int64, unsigned int, _LOOKASIDE_LIST_EX *); 
  __int64 Tag; 
  __int64 Type; 
  INT64 UseLookaside; 
  VOID *Objecta; 
  _UNICODE_STRING CapturedObjectName; 
  _LEARNING_MODE_OBJECT_INFORMATION ObjectInformation[4]; 
  __int128 v32; 
  __int128 v33; 
  __int64 v34; 
  int v35; 
  PADAPTER_OBJECT *a7; 

  Objecta = 0i64;
  v6 = (_OBJECT_TYPE *)AccessMode;
  v34 = 0i64;
  v7 = (unsigned int)ObjectType;
  CapturedObjectName = 0i64;
  *(_OWORD *)ObjectInformation = 0i64;
  v32 = 0i64;
  v33 = 0i64;
  if( !ObjectAttributes || !AccessMode )
    return -1073741811;
  CurrentPrcb = KeGetCurrentPrcb();
  P = CurrentPrcb->PPLookasideList[8].P;
  ++P->TotalAllocates;
  v12 = RtlpInterlockedPopEntrySList(&P->ListHead);
  if( !v12 )
  {
    ++P->AllocateMisses;
    L = CurrentPrcb->PPLookasideList[8].L;
    ++L->TotalAllocates;
    v12 = RtlpInterlockedPopEntrySList(&L->ListHead);
    if( !v12 )
    {
      Size = L->Size;
      AllocateEx = L->AllocateEx;
      Tag = L->Tag;
      Type = (unsigned int)L->Type;
      ++L->AllocateMisses;
      v12 = (PSLIST_ENTRY)((__int64(__fastcall *)(__int64, __int64, __int64))AllocateEx)(Type, Size, Tag);
      if( !v12 )
        return -1073741670;
    }
  }
  Number = CurrentPrcb->Number;
  v14 = v12 + 10;
  LODWORD(UseLookaside) = 1;
  LODWORD(v12->Next) = Number;
  v35 = ObpCaptureObjectCreateInformation(
          (INT8)ParseContext,
          (INT8)ParseContext,
          ObjectAttributes,
          &CapturedObjectName,
          (_OBJECT_CREATE_INFORMATION *)&v12[10],
          UseLookaside);
  if( v35 >= 0 )
  {
    if( !DesiredAccess )
    {
      v35 = SeCreateAccessState((_ACCESS_STATE *)v12, (_AUX_ACCESS_DATA *)&v12[14], v7, &v6->TypeInfo.GenericMapping);
      if( v35 < 0 )
      {
LABEL_14:
        if( (PSLIST_ENTRY)DesiredAccess == v12 )
        {
          SepDeleteAccessState((_ACCESS_STATE *)DesiredAccess);
          SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)(DesiredAccess + 32));
        }
        Next = v12[12].Next;
        if( Next )
        {
          SeReleaseSecurityDescriptor(Next, (CHAR)v12[11].Next, 1u);
          v12[12].Next = 0i64;
        }
        if( CapturedObjectName.Buffer )
          ObpFreeObjectNameBuffer(&CapturedObjectName);
        goto LABEL_20;
      }
      DesiredAccess = (UINT64)v12;
    }
    v35 = ObpAdjustAccessMask((_ACCESS_STATE *)DesiredAccess);
    if( v35 >= 0 )
    {
      Silo = PsGetCurrentSilo();
      v35 = ObpLookupObjectName(
              *((VOID **)&v12[10].Next + 1),
              &CapturedObjectName,
              LODWORD(v14->Next),
              v6,
              (INT8)ParseContext,
              Object,
              0i64,
              0i64,
              Silo,
              (_ACCESS_STATE *)DesiredAccess,
              (_OBP_LOOKUP_CONTEXT *)&v12[28],
              0i64,
              &Objecta);
      if( v35 >= 0 )
      {
        ObpReleaseLookupContext((_OBP_LOOKUP_CONTEXT *)&v12[28]);
        v16 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Objecta - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Objecta - 48) >> 8)];
        if( (*(_DWORD *)(v16 + 72) & (__int64)v14->Next) != 0 )
        {
          HalPutDmaAdapter((PADAPTER_OBJECT)Objecta);
          v35 = -1073741811;
        }
        else
        {
          *(_QWORD *)&v32 = v16 + 16;
          *((_QWORD *)&v32 + 1) = &CapturedObjectName;
          *(_QWORD *)&v33 = *((_QWORD *)&v12[10].Next + 1);
          SeSetLearningModeObjectInformation(ObjectInformation);
          LOBYTE(v17) = (_BYTE)ParseContext;
          if( ObpCheckObjectReference(Objecta, (_ACCESS_STATE *)DesiredAccess, v18, v17) )
            *a7 = (PADAPTER_OBJECT)Objecta;
          else
            HalPutDmaAdapter((PADAPTER_OBJECT)Objecta);
          SeClearLearningModeObjectInformation();
        }
      }
    }
    goto LABEL_14;
  }
LABEL_20:
  v20 = KeGetCurrentPrcb();
  v21 = v20->PPLookasideList[8].P;
  ++v21->TotalFrees;
  if( LOWORD(v21->ListHead.Alignment) < v21->Depth
    || (++v21->FreeMisses,
        v21 = v20->PPLookasideList[8].L,
        ++v21->TotalFrees,
        LOWORD(v21->ListHead.Alignment) < v21->Depth) )
  {
    RtlpInterlockedPushEntrySList(&v21->ListHead, v12);
  }
  else
  {
    ++v21->FreeMisses;
    ((void(__fastcall *)(PSLIST_ENTRY))v21->FreeEx)(v12);
  }
  return v35;
}

Referenced by: