ObpLookupDirectoryEntryEx
VOID *__fastcall ObpLookupDirectoryEntryEx(
_OBJECT_DIRECTORY *Directory,
_UNICODE_STRING *Name,
UINT64 Attributes,
UINT8 SearchShadow,
UINT8 IsSandboxed,
_OBP_LOOKUP_CONTEXT *LookupContext){
wchar_t *Buffer;
bool v9;
unsigned int v10;
unsigned __int64 v12;
__int64 v13;
unsigned int v14;
UINT16 v15;
int v16;
unsigned int v17;
int v18;
VOID *v19;
__int64 v21;
__int64 v22;
__int128 v23;
_OBJECT_DIRECTORY *ShadowDirectory;
Buffer = Name->Buffer;
v9 = (Attributes & 0x40) != 0;
v10 = Name->Length >> 1;
if( v10 < 4 )
{
v14 = 0;
}
else
{
v12 = 0i64;
do
{
v13 = *(_QWORD *)Buffer;
if( (*(_QWORD *)Buffer & 0xFF80FF80FF80FF80ui64) != 0 )
{
v21 = 4i64;
do
{
v22 = (unsigned __int16)v13;
if( (unsigned __int16)v13 >= 0x61u )
{
if( (unsigned __int16)v13 <= 0x7Au )
v22 = (unsigned int)(unsigned __int16)v13 - 32;
else
v22 = NLS_UPCASE(v13);
}
*(_QWORD *)&v23 = v13;
*((_QWORD *)&v23 + 1) = v22;
v13 = v23 >> 16;
--v21;
}
while( v21 );
}
else
{
v13 &= 0xFFDFFFDFFFDFFFDFui64;
}
Buffer += 4;
v10 -= 4;
v12 = v13 + (v12 >> 1) + 3 * v12;
}
while( v10 >= 4 );
v14 = v12 + HIDWORD(v12);
}
while( v10 )
{
v17 = *Buffer;
v18 = (v14 >> 1) + 3 * v14;
++Buffer;
--v10;
if( v17 < 0x61 )
goto LABEL_12;
if( v17 > 0x7A )
{
v15 = NLS_UPCASE(v17);
v14 = v15 + v16;
}
else
{
v18 -= 32;
LABEL_12:
v14 = v17 + v18;
}
}
LookupContext->HashValue = v14;
LookupContext->HashIndex = v14 % 0x25;
v19 = ObpLookupDirectoryUsingHash(Directory, Name, LookupContext, v9);
if( !v19 && SearchShadow )
{
do
{
ShadowDirectory = ObpGetShadowDirectory(Directory);
if( ShadowDirectory )
{
if( LookupContext->DirectoryLocked )
{
ObfReferenceObject(Directory);
ObpUnlockDirectory(Directory, LookupContext);
ObpLockDirectoryShared(LookupContext, ShadowDirectory);
HalPutDmaAdapter((PADAPTER_OBJECT)Directory);
}
v19 = ObpLookupDirectoryUsingHash(ShadowDirectory, Name, LookupContext, v9);
}
Directory = ShadowDirectory;
}
while( !v19 && ShadowDirectory );
}
return v19;
}Referenced by:
ObCloseHandleTableEntry
ObCreateObjectTypeEx
ObpCreateSymbolicLinkName
ObpDeleteNameCheck
ObpLookupDirectoryEntry