ObpInitializeRootNamespace

NTSTATUS __stdcall ObpInitializeRootNamespace(_EJOB *Silo, VOID *RootDirectory, VOID *DosDevicesShadowDirectory){
  UINT8 IsHostSilo; 
  int KernelObjectsSD; 
  bool v8; 
  PVOID *Object; 
  VOID *DirectoryHandle; 
  VOID *ShadowDirectoryHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID v14; 
  __int128 SecurityDescriptor[2]; 
  __int64 v16; 
  int SymbolicLinkInformation; 

  SymbolicLinkInformation = 0;
  DirectoryHandle = 0i64;
  ShadowDirectoryHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  IsHostSilo = PsIsHostSilo(Silo);
  v16 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  KernelObjectsSD = ObCreateKernelObjectsSD(SecurityDescriptor);
  if( KernelObjectsSD >= 0 )
  {
    if( IsHostSilo
      || (ObjectAttributes.RootDirectory = 0i64,
          ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpKernelObjectsPathString,
          ObjectAttributes.Length = 48,
          ObjectAttributes.Attributes = 592,
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
          KernelObjectsSD = ZwOpenDirectoryObject(&ShadowDirectoryHandle, 983055, &ObjectAttributes),
          KernelObjectsSD >= 0) )
    {
      ObjectAttributes.SecurityQualityOfService = 0i64;
      LODWORD(Object) = 0;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpKernelObjectsNameString;
      ObjectAttributes.Length = 48;
      ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
      ObjectAttributes.RootDirectory = RootDirectory;
      ObjectAttributes.Attributes = 592;
      KernelObjectsSD = ZwCreateDirectoryObjectEx(
                          &DirectoryHandle,
                          0xF000Fui64,
                          &ObjectAttributes,
                          ShadowDirectoryHandle,
                          (UINT64)Object);
      if( KernelObjectsSD >= 0 )
      {
        ZwClose((_HANDLE)DirectoryHandle);
        DirectoryHandle = 0i64;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpObjectTypesNameString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = RootDirectory;
        ObjectAttributes.Attributes = 592;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        if( IsHostSilo )
        {
          KernelObjectsSD = ZwCreateDirectoryObject(&DirectoryHandle, 983055, &ObjectAttributes);
          if( KernelObjectsSD < 0 )
            goto LABEL_9;
          v14 = 0i64;
          KernelObjectsSD = ObReferenceObjectByHandle(DirectoryHandle, 0i64, DmaAdapter, 0, &v14, 0i64);
          Directory = (PADAPTER_OBJECT)v14;
          v8 = KernelObjectsSD < 0;
        }
        else
        {
          KernelObjectsSD = ZwCreateSymbolicLinkObject(
                              &DirectoryHandle,
                              983041,
                              &ObjectAttributes,
                              (_UNICODE_STRING *)&ObpObjectTypesPathString);
          if( KernelObjectsSD < 0 )
            goto LABEL_9;
          KernelObjectsSD = ZwSetInformationSymbolicLink(
                              DirectoryHandle,
                              SymbolicLinkGlobalInformation,
                              &SymbolicLinkInformation,
                              4ui64);
          v8 = KernelObjectsSD < 0;
        }
        if( !v8 )
          KernelObjectsSD = ObpCreateDosDevicesDirectory(Silo, RootDirectory, DosDevicesShadowDirectory);
      }
    }
  }
LABEL_9:
  if( DirectoryHandle )
    ZwClose((_HANDLE)DirectoryHandle);
  if( ShadowDirectoryHandle )
    ZwClose((_HANDLE)ShadowDirectoryHandle);
  ObCleanupSecurityDescriptor(SecurityDescriptor);
  return KernelObjectsSD;
}

Referenced by: