NtCreatePrivateNamespace

NTSTATUS __fastcall NtCreatePrivateNamespace(
        VOID **NamespaceHandle,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        VOID *BoundaryDescriptor,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  unsigned int v9; 
  char PreviousMode; 
  __int64 v12; 
  NTSTATUS result; 
  _DWORD *v14; 
  NTSTATUS v15; 
  UINT64 v16; 
  unsigned __int64 v17; 
  PVOID *p_Object; 
  NTSTATUS v19; 
  _QWORD *v20; 
  unsigned __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  int inserted; 
  _KSPIN_LOCK *v25; 
  _ESERVERSILO_GLOBALS *CurrentServerSiloGlobals; 
  _ETHREAD *CurrentThread; 
  _QWORD *v28; 
  __int64 v29; 
  _QWORD *v30; 
  __int64 v31; 
  _QWORD *v32; 
  VOID *Flags; 
  UINT64 Flagsa; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  PVOID Object; 
  PVOID P; 
  PVOID Handle; 

  v9 = DesiredAccess;
  Object = 0i64;
  Handle = 0i64;
  P = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v12 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)NamespaceHandle < 0x7FFFFFFF0000i64 )
      v12 = (__int64)NamespaceHandle;
    *(_QWORD *)v12 = *(_QWORD *)v12;
  }
  result = (unsigned int)ObpCaptureBoundaryDescriptor(
                           (_KNOWN_CONTROLLER_TYPE)BoundaryDescriptor,
                           (_KNOWN_CONTROLLER_TYPE **)&P);
  if( result >= 0 )
  {
    v14 = P;
    v15 = ObpVerifyCreatorAccessCheck((_DWORD *)P + 12);
    if( v15 >= 0 )
    {
      v17 = (unsigned int)(v14[6] + 392);
      if( v17 < *((_QWORD *)v14 + 3) )
      {
        v15 = -1073741811;
      }
      else
      {
        p_Object = &Object;
        LODWORD(NonPagedPoolCharge) = 0;
        LODWORD(PagedPoolCharge) = 0;
        LODWORD(ObjectBodySize) = v14[6] + 392;
        LOBYTE(v16) = PreviousMode;
        LOBYTE(p_Object) = PreviousMode;
        v19 = ObCreateObjectEx(
                (UINT64)p_Object,
                DmaAdapter,
                ObjectAttributes,
                v16,
                Flags,
                ObjectBodySize,
                PagedPoolCharge,
                NonPagedPoolCharge,
                &Object,
                0i64);
        if( v19 >= 0 )
        {
          v20 = Object;
          memset(Object, 0i64, v17);
          v21 = ((unsigned __int64)v20 + 351) & 0xFFFFFFFFFFFFFFF8ui64;
          *(_QWORD *)(v21 + 8) = v21;
          *(_QWORD *)v21 = v21;
          v22 = *((_QWORD *)v14 + 3);
          *(_QWORD *)(v21 + 24) = v22;
          *(_QWORD *)(v21 + 16) = 0i64;
          *(_BYTE *)(v21 + 40) = *((_BYTE *)v14 + 40);
          memmove((VOID *)(v21 + 48), v14 + 12, v22);
          ExFreePoolWithTag(v14, 0x534E624Fu);
          v20[37] = 0i64;
          *((_DWORD *)v20 + 85) = -1;
          *((_DWORD *)v20 + 84) = 1;
          if( (*((_BYTE *)v20 - 22) & 2) != 0 )
            v23 = (__int64)v20 - *((unsigned __int8 *)&dword_140C25D60 + (*((_BYTE *)v20 - 22) & 3)) - 48;
          else
            v23 = 0i64;
          if( v23 )
          {
            inserted = -1073741773;
          }
          else
          {
            inserted = ObpRegisterPrivateNamespace(((unsigned __int64)v20 + 351) & 0xFFFFFFFFFFFFFFF8ui64);
            if( inserted >= 0 )
            {
              ObfReferenceObject(v20);
              LODWORD(Flagsa) = 0;
              inserted = ObInsertObjectEx(v20, 0i64, v9, 0i64, Flagsa, 0i64, &Handle);
              CurrentServerSiloGlobals = PsGetCurrentServerSiloGlobals(v25);
              CurrentThread = (_ETHREAD *)KeGetCurrentThread();
              --CurrentThread->Tcb.KernelApcDisable;
              ExAcquirePushLockExclusiveEx(
                &CurrentServerSiloGlobals->ObSiloState.PrivateNamespaceLookupTable.Lock,
                0i64);
              if( inserted < 0 )
              {
                v29 = *(_QWORD *)v21;
                v30 = *(_QWORD **)(v21 + 8);
                if( *(_QWORD *)(*(_QWORD *)v21 + 8i64) == v21 && *v30 == v21 )
                {
                  *v30 = v29;
                  *(_QWORD *)(v29 + 8) = v30;
LABEL_32:
                  --CurrentServerSiloGlobals->ObSiloState.PrivateNamespaceLookupTable.NumberOfPrivateSpaces;
                  HalPutDmaAdapter((PADAPTER_OBJECT)Object);
LABEL_16:
                  ExReleasePushLockEx((_DWORD)CurrentServerSiloGlobals + 720, 0);
                  KeLeaveCriticalRegionThread(KeGetCurrentThread());
                  if( inserted >= 0 )
                    *NamespaceHandle = Handle;
                  return inserted;
                }
              }
              else
              {
                if( (v20[42] & 2) == 0 )
                {
                  v28 = Object;
                  *(_QWORD *)(v21 + 16) = Object;
                  v28[40] = v21;
                  goto LABEL_16;
                }
                v31 = *(_QWORD *)v21;
                v32 = *(_QWORD **)(v21 + 8);
                if( *(_QWORD *)(*(_QWORD *)v21 + 8i64) == v21 && *v32 == v21 )
                {
                  *v32 = v31;
                  *(_QWORD *)(v31 + 8) = v32;
                  goto LABEL_32;
                }
              }
              __fastfail(3u);
            }
          }
          HalPutDmaAdapter((PADAPTER_OBJECT)v20);
          return inserted;
        }
        v15 = v19;
      }
    }
    ExFreePoolWithTag(v14, 0x534E624Fu);
    return v15;
  }
  return result;
}

Referenced by: