ObReferenceObjectByNameEx

__int64 __fastcall ObReferenceObjectByNameEx(
        __int64 a1,
        struct _SECURITY_SUBJECT_CONTEXT *a2,
        DWORD a3,
        __int64 a4,
        INT64 a5,
        __int64 a6,
        PADAPTER_OBJECT *a7){
  struct _KPRCB *CurrentPrcb; 
  __int64 v12; 
  INT64 v13; 
  INT64 v14; 
  PSLIST_ENTRY v15; 
  int v16; 
  CHAR v17; 
  struct _SLIST_ENTRY *v18; 
  _EJOB *Silo; 
  __int64 v20; 
  UINT8 v21; 
  _SLIST_ENTRY *Next; 
  struct _KPRCB *v23; 
  __int64 v24; 
  __int64 v26; 
  __int64 v27; 
  __int64(__fastcall *v28)(__int64, __int64, __int64); 
  __int64 v29; 
  __int64 v30; 
  _OBJECT_CREATE_INFORMATION *ObjectCreateInfo; 
  INT64 UseLookaside; 
  _SECURITY_QUALITY_OF_SERVICE *SecurityQos; 
  PVOID InsertObject; 
  PADAPTER_OBJECT DmaAdapter; 
  _UNICODE_STRING CapturedObjectName; 
  INT64 v37[2]; 
  __int128 v38; 
  __int128 v39; 
  __int64 v40; 
  INT64 AccessStatus; 
  DmaAdapter = 0i64;
  v40 = 0i64;
  CapturedObjectName = 0i64;
  *(_OWORD *)v37 = 0i64;
  v38 = 0i64;
  v39 = 0i64;
  if( !a1 || !a4 )
    return 3221225485i64;
  CurrentPrcb = KeGetCurrentPrcb();
  v12 = *((_QWORD *)CurrentPrcb + 272);
  ++*(_DWORD *)(v12 + 20);
  v15 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v12);
  if( !v15 )
  {
    ++*(_DWORD *)(v12 + 24);
    v26 = *((_QWORD *)CurrentPrcb + 273);
    ++*(_DWORD *)(v26 + 20);
    v15 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v26);
    if( !v15 )
    {
      v27 = *(unsigned int *)(v26 + 44);
      v28 = *(__int64(__fastcall **)(__int64, __int64, __int64))(v26 + 48);
      v29 = *(unsigned int *)(v26 + 40);
      v30 = *(unsigned int *)(v26 + 36);
      ++*(_DWORD *)(v26 + 24);
      v15 = (PSLIST_ENTRY)v28(v30, v27, v29);
      if( !v15 )
        return 3221225626i64;
    }
  }
  v16 = *((_DWORD *)CurrentPrcb + 9);
  v17 = a5;
  v18 = v15 + 10;
  LOBYTE(v13) = a5;
  LODWORD(UseLookaside) = 1;
  LOBYTE(v14) = a5;
  LODWORD(v15->Next) = v16;
  LODWORD(AccessStatus) = ObpCaptureObjectCreateInformation(
                            v14,
                            v13,
                            (_OBJECT_ATTRIBUTES *)a1,
                            &CapturedObjectName,
                            (_OBJECT_CREATE_INFORMATION *)&v15[10],
                            UseLookaside,
                            (INT64)SecurityQos,
                            (INT64)InsertObject);
  if( (int)AccessStatus >= 0 )
  {
    if( !a2 )
    {
      LODWORD(AccessStatus) = SeCreateAccessState(
                                (_ACCESS_STATE *)v15,
                                (_AUX_ACCESS_DATA *)&v15[14],
                                a3,
                                (_GENERIC_MAPPING *)(a4 + 76));
      if( (int)AccessStatus < 0 )
      {
LABEL_14:
        if( a2 == (struct _SECURITY_SUBJECT_CONTEXT *)v15 )
        {
          SepDeleteAccessState((ACCESS_STATE *)a2);
          SeReleaseSubjectContext(a2 + 1);
        }
        Next = v15[12].Next;
        if( Next )
        {
          SeReleaseSecurityDescriptor(Next, (INT8)v15[11].Next, 1u);
          v15[12].Next = 0i64;
        }
        if( CapturedObjectName.Buffer )
          ObpFreeObjectNameBuffer(&CapturedObjectName);
        goto LABEL_20;
      }
      a2 = (struct _SECURITY_SUBJECT_CONTEXT *)v15;
    }
    LODWORD(AccessStatus) = ObpAdjustAccessMask((ACCESS_STATE *)a2);
    if( (int)AccessStatus >= 0 )
    {
      Silo = PsGetCurrentSilo();
      LOBYTE(ObjectCreateInfo) = v17;
      LODWORD(AccessStatus) = ObpLookupObjectName(
                                *((VOID **)&v15[10].Next + 1),
                                &CapturedObjectName,
                                LODWORD(v18->Next),
                                (_OBJECT_TYPE *)a4,
                                (INT64)ObjectCreateInfo,
                                (VOID *)a6,
                                0i64,
                                0i64,
                                Silo,
                                (_ACCESS_STATE *)a2,
                                (_OBP_LOOKUP_CONTEXT *)&v15[28],
                                0i64,
                                (VOID **)&DmaAdapter);
      if( (int)AccessStatus >= 0 )
      {
        ObpReleaseLookupContext((INT64)&v15[28]);
        v20 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(DmaAdapter[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8)];
        if( (*(_DWORD *)(v20 + 72) & (__int64)v18->Next) != 0 )
        {
          HalPutDmaAdapter(DmaAdapter);
          LODWORD(AccessStatus) = -1073741811;
        }
        else
        {
          *(_QWORD *)&v38 = v20 + 16;
          *((_QWORD *)&v38 + 1) = &CapturedObjectName;
          *(_QWORD *)&v39 = *((_QWORD *)&v15[10].Next + 1);
          SeSetLearningModeObjectInformation((INT64)v37);
          if( ObpCheckObjectReference(DmaAdapter, (_ACCESS_STATE *)a2, v21, v17, &AccessStatus) )
            *a7 = DmaAdapter;
          else
            HalPutDmaAdapter(DmaAdapter);
          SeClearLearningModeObjectInformation();
        }
      }
    }
    goto LABEL_14;
  }
LABEL_20:
  v23 = KeGetCurrentPrcb();
  v24 = *((_QWORD *)v23 + 272);
  ++*(_DWORD *)(v24 + 28);
  if( *(_WORD *)v24 < *(_WORD *)(v24 + 16)
    || (++*(_DWORD *)(v24 + 32),
        v24 = *((_QWORD *)v23 + 273),
        ++*(_DWORD *)(v24 + 28),
        *(_WORD *)v24 < *(_WORD *)(v24 + 16)) )
  {
    RtlpInterlockedPushEntrySList((PSLIST_HEADER)v24, v15);
  }
  else
  {
    ++*(_DWORD *)(v24 + 32);
    (*(void(__fastcall **)(PSLIST_ENTRY))(v24 + 56))(v15);
  }
  return(unsigned int)AccessStatus;
}

Referenced by: