ObpLookupNamespaceEntry
INT64 *__fastcall ObpLookupNamespaceEntry(INT64 a1, INT64 a2){
INT64 *v3;
INT64 i;
int v6;
__int128 v7;
__int128 v8;
__int64 v9;
v3 = (INT64 *)(a1 + 16i64 * *(unsigned __int8 *)(a2 + 40));
for( i = *v3; ; i = *(_QWORD *)i )
{
if( (INT64 *)i == v3 )
return 0i64;
if( *(_QWORD *)(i + 24) == *(_QWORD *)(a2 + 24) )
{
v9 = 0i64;
v6 = *(_DWORD *)(a2 + 52);
v7 = 0i64;
v8 = 0i64;
if( *(_DWORD *)(i + 52) == v6 )
{
LODWORD(v9) = 0;
*((_QWORD *)&v8 + 1) = 0i64;
*(_QWORD *)&v7 = i;
*((_QWORD *)&v7 + 1) = a2;
if( (int)RtlEnumerateBoundaryDescriptorEntries(
(_DWORD *)(i + 48),
(unsigned int(__fastcall *)(_DWORD *, __int64))ObpCompareEntryLevel1,
(__int64)&v7) >= 0
&& (int)v9 >= 0
&& HIDWORD(v8) == DWORD2(v8) )
{
break;
}
}
}
}
return(INT64 *)i;
}Referenced by:
NtOpenPrivateNamespace