IopSymlinkRememberJunction

INT64 __fastcall IopSymlinkRememberJunction(INT16 a1, FILE_OBJECT *a2, INT64 a3, UNICODE_STRING *a4){
  int RelatedFileName; 
  _RELATIVE_SYMLINK_INFO *RelatedMountPoint; 
  INT64 v10; 
  _RELATIVE_SYMLINK_INFO *MostRecentlyUsedName; 
  _RELATIVE_SYMLINK_INFO *v12; 
  __int16 v13; 
  _RELATIVE_SYMLINK_INFO *PoolWithTag; 
  __int64 v16; 
  UINT16 DeviceNameLength; 
  _RELATIVE_SYMLINK_INFO *SymlinkInfo; 
  struct _UNICODE_STRING Destination; 
  RelatedFileName = 0;
  RelatedMountPoint = (_RELATIVE_SYMLINK_INFO *)IopSymlinkGetRelatedMountPoint((INT64)a4, a1);
  MostRecentlyUsedName = RelatedMountPoint;
  if( RelatedMountPoint )
  {
    RelatedMountPoint->ExposedNamespaceLength = a1;
    IopSymlinkFreeRelatedMountPointChain((INT64)RelatedMountPoint);
  }
  else
  {
    MostRecentlyUsedName = (_RELATIVE_SYMLINK_INFO *)IopSymlinkGetMostRecentlyUsedName(v10);
    SymlinkInfo = MostRecentlyUsedName;
    MostRecentlyUsedName->Flags |= v13;
    MostRecentlyUsedName->ExposedNamespaceLength = a1;
    if( v12 == MostRecentlyUsedName )
    {
      if( a2->RelatedFileObject )
      {
        v16 = (unsigned __int16)(v12->OpenedName.Length + 2);
        *(_QWORD *)&Destination.Length = 0i64;
        Destination.Buffer = 0i64;
        DeviceNameLength = 0;
        RelatedFileName = IopGetRelatedFileName(a2, &Destination, v16, &DeviceNameLength);
        if( RelatedFileName >= 0 )
        {
          RtlAppendUnicodeToString(&Destination, (PWCHAR)L"\\");
          RtlAppendUnicodeStringToString(&Destination, a4 + 1);
          RelatedFileName = IopSymlinkUpdateECP((IRP *)a3, a4, a1, &Destination, DeviceNameLength, a4->MaximumLength);
          ExFreePoolWithTag(Destination.Buffer, 0);
          if( RelatedFileName < 0 )
            return(unsigned int)RelatedFileName;
          IopSymlinkGetECP(*(_ECP_LIST **)(a3 + 112), &SymlinkInfo);
          MostRecentlyUsedName = SymlinkInfo;
        }
      }
    }
  }
  PoolWithTag = (_RELATIVE_SYMLINK_INFO *)ExAllocatePoolWithTag(PagedPool, a2->FileName.Length + 32i64, 0x69536F49ui64);
  MostRecentlyUsedName->InteriorMountPoint = PoolWithTag;
  if( PoolWithTag )
    IopSymlinkInitializeSymlinkInfo(
      (INT64)PoolWithTag,
      a2->FileName.Length + 32,
      a2->FileName.Buffer,
      a2->FileName.Length,
      0,
      0i64,
      0,
      0,
      0,
      0i64);
  else
    return(unsigned int)-1073741670;
  return(unsigned int)RelatedFileName;
}

Referenced by: