RtlpGetNormalization

INT64 __stdcall RtlpGetNormalization(UINT64 NormForm, PVOID *ppNormalization){
  unsigned int v3; 
  INT64 result; 
  INT64 v5; 
  VOID **v6; 
  VOID **v7; 
  UINT64 v8; 
  NTSTATUS NlsSectionPtr; 
  CHAR *v10; 
  CHAR *v11; 
  int Tables; 
  __int128 SectionSize; 
  v3 = NormForm;
  if( !ppNormalization )
    return 3221225712i64;
  NormalizationList__Lock();
  v6 = NormalizationList__Lookup(v3);
  if( !v6 )
  {
    LODWORD(v5) = v5 ^ 0x100;
    SectionSize = 0ui64;
    v7 = NormalizationList__Lookup(v5);
    if( v7 )
    {
      *((_QWORD *)&SectionSize + 1) = v7[1];
      *(_QWORD *)&SectionSize = v7[2];
    }
    else
    {
      v8 = v3;
      LODWORD(v8) = v3 & 0xFFFFFEFF;
      NlsSectionPtr = ZwGetNlsSectionPtr(0xCui64, v8, 0i64, (PVOID *)&SectionSize + 1, (UINT64 *)&SectionSize);
      if( NlsSectionPtr < 0 )
        goto LABEL_12;
    }
    v10 = NormalizationListEntry_Alloc();
    v11 = v10;
    if( !v10 )
    {
      NlsSectionPtr = -1073741801;
LABEL_12:
      NormalizationList__Unlock();
      return(unsigned int)NlsSectionPtr;
    }
    v6 = (VOID **)(v10 + 24);
    Tables = Normalization__LoadTables(v3, *((UINT16 **)&SectionSize + 1), SectionSize, (INT64)(v10 + 24));
    if( Tables < 0 )
    {
      ExFreePoolWithTag(v11, 0);
      NlsSectionPtr = Tables;
      goto LABEL_12;
    }
    *((_DWORD *)v11 + 4) = v3;
    NormalizationList__InsertTail((PVOID **)v11);
  }
  NormalizationList__Unlock();
  result = 0i64;
  *ppNormalization = v6;
  return result;
}

Referenced by: