DrvDbGetObjectDatabaseNode

NTSTATUS __stdcall DrvDbGetObjectDatabaseNode(
        _ETHREAD *Thread,
        PVOID Token,
        UINT8 CopyOnOpen,
        UINT8 EffectiveOnly,
        _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel){
  int DatabaseNode; 
  _DRVDB_NODE **v6; 
  bool v7; 
  _QWORD *v8; 
  PVOID v11; 
  wchar_t *v13; 
  WORD *v14; 
  _UNICODE_STRING StringIn; 
  _UNICODE_STRING StringOut[2]; 

  DatabaseNode = 0;
  *(_DWORD *)(&StringIn.MaximumLength + 1) = 0;
  v6 = (_DRVDB_NODE **)EffectiveOnly;
  v7 = *(_WORD *)Token == 64;
  v8 = (_QWORD *)CopyOnOpen;
  StringOut[0] = 0i64;
  if( !v7
    || (v13 = (wchar_t *)((char *)Token + 2), (v14 = wcschr((WORD *)Token + 1, 58)) == 0i64)
    || (StringIn.Buffer = v13,
        StringIn.Length = 2 * (v14 - v13),
        StringIn.MaximumLength = StringIn.Length,
        v11 = v14 + 1,
        v14 == (WORD *)-2i64) )
  {
    v11 = Token;
LABEL_3:
    *v6 = (_DRVDB_NODE *)Thread->Tcb.InitialStack;
    goto LABEL_4;
  }
  if( v11 == Token )
    goto LABEL_3;
  DatabaseNode = RtlDuplicateUnicodeString(1ui64, &StringIn, StringOut);
  if( DatabaseNode < 0 )
    return DatabaseNode;
  DatabaseNode = DrvDbFindDatabaseNode((_DRVDB_CONTEXT *)Thread, StringOut[0].Buffer, v6);
  RtlFreeAnsiString(StringOut);
  if( DatabaseNode == -1073741772 )
    return -1073741766;
  if( DatabaseNode < 0 )
    return DatabaseNode;
LABEL_4:
  *v8 = v11;
  return DatabaseNode;
}

Referenced by:

DrvDbDeleteObjectRegKey
DrvDbOpenObjectRegKey