VrpPostOpenOrCreate

NTSTATUS __stdcall VrpPostOpenOrCreate(_REG_POST_OPERATION_INFORMATION *PostInfo){
  void *v1; 
  void *v2; 
  _DWORD *Object; 
  UNICODE_STRING *v5; 
  __int64 v6; 
  UNICODE_STRING *v7; 
  int v8; 
  UNICODE_STRING *v9; 
  __int64 v10; 
  INT64 v11; 
  INT64 v12; 
  INT64 v13; 
  struct _LOOKASIDE_LIST_EX *v14; 
  UNICODE_STRING *v15; 
  UNICODE_STRING *v16; 
  int v17; 
  NTSTATUS v18; 
  UNICODE_STRING *ExtraParameter; 
  int v20; 
  int ExtraParameterInBlock; 
  __int64 v22; 
  _QWORD *v23; 
  _QWORD *v24; 
  struct _DMA_ADAPTER *v25; 
  int v26; 
  __int64 *v27; 
  void *v28; 
  __int64 *v30; 
  __int64 v31; 
  int v32; 
  __int64 *v33; 
  __int64 v34; 
  int v35; 
  PVOID OldContext; 
  _DWORD *v37; 
  GUID ActivityId; 
  struct _EVENT_DATA_DESCRIPTOR v39[2]; 
  int *v40; 
  int v41; 
  int v42; 
  __int64 v43; 
  int v44; 
  int v45; 
  PVOID *p_OldContext; 
  int v47; 
  int v48; 
  v2 = v1;
  ActivityId = 0i64;
  EtwActivityIdControl(3u, &ActivityId);
  Object = PostInfo->Object;
  v5 = 0i64;
  v6 = *(_QWORD *)&PostInfo->Status;
  v7 = 0i64;
  OldContext = 0i64;
  v37 = Object;
  v8 = Object[2];
  v9 = (UNICODE_STRING *)*((_QWORD *)Object + 4);
  v10 = *((_QWORD *)Object + 2);
  if( v8 < 0 )
    goto LABEL_16;
  CmRetrieveExtraParameter(*(_QWORD **)(v6 + 16));
  if( v8 == 260 )
    goto LABEL_16;
  if( v8 == 872 )
  {
    if( !v9 )
      return 0;
    ExtraParameter = (UNICODE_STRING *)CmAllocateExtraParameter(v12, v11, v13, v14);
    v7 = ExtraParameter;
    if( !ExtraParameter )
      goto LABEL_31;
    VrpBuildKeyPath(0i64, v9 + 3, ExtraParameter + 1);
    v18 = v20;
    if( v20 < 0 )
    {
LABEL_32:
      if( (unsigned int)CallbackContext > 2 )
      {
        v30 = &EmptyUnicodeString;
        if( *(_QWORD *)(*(_QWORD *)v10 + 8i64) )
          v30 = *(__int64 **)v10;
        v31 = v30[1];
        v32 = *(unsigned __int16 *)v30;
        v42 = 0;
        v45 = 0;
        v48 = 0;
        v43 = v31;
        p_OldContext = &OldContext;
        v40 = &v44;
        v44 = v32;
        v41 = 2;
        LODWORD(OldContext) = v18;
        v47 = 4;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&CallbackContext,
          (unsigned __int8 *)&unk_1400235F0,
          &ActivityId,
          0i64,
          5u,
          v39);
      }
      if( v5 )
        VrpFreeKeyContext(v5);
      if( v7 )
        CmpFreeExtraParameter((UINT64 *)&v7[-3].Length);
      goto LABEL_17;
    }
    ObfReferenceObjectWithTag(v9->Buffer, 0x67655256u);
    *(_QWORD *)&v7->Length = v9->Buffer;
    LODWORD(v7->Buffer) = *(_DWORD *)&v9[4].Length;
    ExtraParameterInBlock = CmpFindExtraParameterInBlock(*(_QWORD **)(v6 + 16), &v7[-2].Length, &OldContext);
    v18 = ExtraParameterInBlock;
    if( ExtraParameterInBlock >= 0 )
    {
      v18 = -1073741771;
      goto LABEL_32;
    }
    if( ExtraParameterInBlock == -1073741772 )
    {
      v24 = *(_QWORD **)(v22 + 8);
      if( *v24 != v22 )
        __fastfail(3u);
      *v23 = v22;
      v18 = 0;
      v23[1] = v24;
      *v24 = v23;
      *(_QWORD *)(v22 + 8) = v23;
    }
    if( v18 < 0 )
      goto LABEL_32;
LABEL_16:
    v18 = 0;
    goto LABEL_17;
  }
  LODWORD(v15) = VrpAllocateKeyContext(v2);
  v5 = v15;
  if( !v15 )
  {
LABEL_31:
    v18 = -1073741670;
    goto LABEL_32;
  }
  v16 = v15 + 1;
  VrpBuildKeyPath(0i64, v9 + 3, v15 + 1);
  v18 = v17;
  if( v17 < 0 )
    goto LABEL_32;
  *(_DWORD *)(&v5[2].MaximumLength + 1) = *(_DWORD *)&v9[4].Length;
  v5[2].Length = VrpCountPathComponents(v16);
  v18 = (unsigned int)CmSetCallbackObjectContext((_POOL_TYPE)**(_QWORD **)(v10 + 72), (UINT64)&VrpCallbackCookie);
  if( v18 < 0 )
    goto LABEL_32;
LABEL_17:
  if( v9 )
  {
    v25 = *(struct _DMA_ADAPTER **)(v10 + 8);
    if( v25 )
      HalPutDmaAdapter(v25);
    *(_QWORD *)(v10 + 8) = *(_QWORD *)&v9->Length;
    *(_QWORD *)&v9->Length = 0i64;
    v26 = v37[2];
    if( v26 == 872 || v26 == 260 )
    {
      if( (unsigned int)CallbackContext > 5 )
      {
        v33 = &EmptyUnicodeString;
        if( *(_QWORD *)(*(_QWORD *)v10 + 8i64) )
          v33 = *(__int64 **)v10;
        v34 = v33[1];
        v35 = *(unsigned __int16 *)v33;
        v42 = 0;
        v45 = 0;
        v48 = 0;
        v43 = v34;
        p_OldContext = &OldContext;
        v40 = &v44;
        v44 = v35;
        v41 = 2;
        LODWORD(OldContext) = v18;
        v47 = 4;
        tlgWriteTransfer_EtwWriteTransfer(
          (__int64)&CallbackContext,
          (unsigned __int8 *)word_1400233B2,
          &ActivityId,
          0i64,
          5u,
          v39);
      }
    }
    else
    {
      v27 = *(__int64 **)v10;
      v28 = *(void **)(*(_QWORD *)v10 + 8i64);
      if( v28 )
      {
        ExFreePoolWithTag(v28, 0);
        v27 = *(__int64 **)v10;
      }
      *(UNICODE_STRING *)v27 = v9[1];
      *(UNICODE_STRING *)*(_QWORD *)(v10 + 112) = v9[2];
      v9[1].Buffer = 0i64;
      v9[2].Buffer = 0i64;
    }
    VrpFreeCallbackContext(v9);
  }
  return v18;
}

Referenced by: