ObpParseSymbolicLinkEx

NTSTATUS __stdcall ObpParseSymbolicLinkEx(
        PVOID ParseObject,
        PVOID ObjectType,
        ACCESS_STATE *AccessState,
        INT8 AccessMode,
        UINT64 Attributes,
        UNICODE_STRING *CompleteName,
        UNICODE_STRING *RemainingName,
        PVOID Context,
        SECURITY_QUALITY_OF_SERVICE *SecurityQos,
        _OB_EXTENDED_PARSE_PARAMETERS *ExtendedParameters,
        PVOID *Object){
  int v12; 
  UNICODE_STRING *v15; 
  int v16; 
  _OB_EXTENDED_PARSE_PARAMETERS *v17; 
  __int128 *v18; 
  unsigned int v19; 
  int Length; 
  unsigned __int16 v21; 
  UNICODE_STRING *v22; 
  unsigned __int16 MaximumLength; 
  UINT8 *PoolWithTag; 
  wchar_t *Buffer; 
  PADAPTER_OBJECT v26; 
  PVOID *v27; 
  NTSTATUS v29; 
  NTSTATUS v30; 
  __int128 v31; 
  PADAPTER_OBJECT DmaAdapter; 
  DmaAdapter = 0i64;
  v12 = *((_DWORD *)ParseObject + 7);
  v31 = 0i64;
  if( (v12 & 2) != 0 && !(unsigned __int8)RtlIsSandboxedToken((_SECURITY_SUBJECT_CONTEXT *)AccessState + 1, AccessMode) )
  {
    v30 = -1073741772;
    goto LABEL_24;
  }
  v15 = RemainingName;
  if( RemainingName->Length )
  {
    if( *RemainingName->Buffer != 92 )
    {
      v30 = -1073741788;
      goto LABEL_24;
    }
  }
  else if( ObjectType == ObpSymbolicLinkObjectType
         && ((*((_DWORD *)ParseObject + 7) & 1) == 0 || !PsIsCurrentThreadInServerSilo()) )
  {
    v29 = ObReferenceObjectByPointer(ParseObject, 0, (POBJECT_TYPE)ObjectType, AccessMode);
    v30 = v29;
    if( v29 >= 0 )
    {
      *Object = ParseObject;
LABEL_24:
      if( DmaAdapter )
        HalPutDmaAdapter(DmaAdapter);
      return v30;
    }
    if( v29 != -1073741788 )
      goto LABEL_24;
  }
  v16 = *((_DWORD *)ParseObject + 7);
  v17 = ExtendedParameters;
  if( (v16 & 8) != 0 )
  {
    ExtendedParameters->RestrictedAccessMask &= *((_DWORD *)ParseObject + 8);
    v16 = *((_DWORD *)ParseObject + 7);
  }
  if( (v16 & 4) != 0 )
  {
    v17->Silo = (_EJOB *)HalSystemVectorDispatchEntry();
    v16 = *((_DWORD *)ParseObject + 7);
  }
  v18 = (__int128 *)((char *)ParseObject + 8);
  if( (v16 & 0x10) != 0 )
  {
    v30 = (*(__int64(__fastcall **)(PVOID, _QWORD, __int128 *, PADAPTER_OBJECT *))v18)(
            ParseObject,
            *((_QWORD *)ParseObject + 2),
            &v31,
            &DmaAdapter);
    if( v30 < 0 )
      goto LABEL_24;
    v18 = &v31;
  }
  v19 = *(unsigned __int16 *)v18;
  if( *(_WORD *)v18
    && *(_WORD *)(*((_QWORD *)v18 + 1) + 2 * ((unsigned __int64)*(unsigned __int16 *)v18 >> 1) - 2) == 92
    && v15->Length
    && *v15->Buffer == 92 )
  {
    v19 -= 2;
  }
  Length = v15->Length;
  v21 = Length + v19;
  if( Length + v19 > 0xFFF0 )
  {
    v30 = -1073741562;
    goto LABEL_24;
  }
  v22 = CompleteName;
  MaximumLength = CompleteName->MaximumLength;
  if( MaximumLength <= v21 )
  {
    MaximumLength = v21 + 2;
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned __int16)(Length + v19 + 2), 0x6D4E624Fui64);
    if( !PoolWithTag )
    {
      v30 = -1073741670;
      goto LABEL_24;
    }
    LOWORD(Length) = v15->Length;
  }
  else
  {
    PoolWithTag = (UINT8 *)CompleteName->Buffer;
  }
  if( (_WORD)Length )
    memmove(&PoolWithTag[v19], (UINT8 *)v15->Buffer, (unsigned __int16)Length);
  memmove(PoolWithTag, *((UINT8 **)v18 + 1), v19);
  *(_WORD *)&PoolWithTag[2 * ((unsigned __int64)v21 >> 1)] = 0;
  Buffer = v22->Buffer;
  if( PoolWithTag != (UINT8 *)Buffer && Buffer )
    ExFreePoolWithTag(Buffer, 0);
  v26 = DmaAdapter;
  v27 = Object;
  v22->Buffer = (wchar_t *)PoolWithTag;
  v22->Length = v21;
  v22->MaximumLength = MaximumLength;
  if( v26 )
  {
    *v27 = v26;
    return 280;
  }
  else
  {
    *v27 = ParseObject;
    if( (*((_DWORD *)ParseObject + 7) & 1) != 0 )
      return 872;
    else
      return 260;
  }
}

Referenced by: