VrpHandleIoctlCreateMultipleNamespaceNodes

INT64 __stdcall VrpHandleIoctlCreateMultipleNamespaceNodes(PVOID Data, UINT64 DataLength, INT8 RequestorMode){
  unsigned int v3; 
  _QWORD *v5; 
  UINT64 *v6; 
  unsigned __int64 v7; 
  int v8; 
  int JobSilo; 
  unsigned __int64 v10; 
  UINT64 v11; 
  NTSTATUS PermanentSiloContext; 
  WCHAR *v13; 
  SIZE_T v14; 
  WCHAR *v15; 
  unsigned __int64 v16; 
  char *v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  __int64 v20; 
  int v21; 
  _QWORD *PoolWithTag; 
  VOID *v23; 
  unsigned int v24; 
  _QWORD *i; 
  _QWORD *j; 
  INT64 v27; 
  SIZE_T Tag; 
  INT64 Taga; 
  WCHAR *Object; 
  PVOID *Objecta; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  WCHAR *v34; 
  UINT64 v35; 
  CHAR *v36; 
  VOID *v37[2]; 
  UNICODE_STRING v38; 
  unsigned int v39; 
  PWCHAR FullPath; 
  INT64 v41; 
  PVOID v42; 
  v39 = DataLength;
  v3 = DataLength;
  v42 = 0i64;
  v5 = 0i64;
  FullPath = 0i64;
  v6 = 0i64;
  v41 = 0i64;
  v7 = 12i64;
  v8 = 0;
  if( (unsigned int)DataLength >= 0xC )
  {
    ObReferenceObjectByHandleWithTag(
      *(HANDLE *)Data,
      6u,
      (POBJECT_TYPE)PsJobType,
      RequestorMode,
      0x52566D43u,
      &v42,
      0i64);
    JobSilo = PsGetJobSilo((_EJOB *)v42, (_EJOB **)&v41);
    if( JobSilo < 0 )
      goto LABEL_34;
    if( !PsIsThreadInSilo((__int64)KeGetCurrentThread(), v41) )
    {
      v35 = v11;
      VRegEnabledInJob(&v35);
      PermanentSiloContext = PsGetPermanentSiloContext(
                               (_EJOB *)v41,
                               (unsigned int)VrpSiloContextSlot,
                               (PVOID *)&FullPath);
      v6 = (UINT64 *)FullPath;
      JobSilo = PermanentSiloContext;
      if( PermanentSiloContext < 0 )
        goto LABEL_34;
      VrpLockJobContextExclusive(
        FullPath,
        v13,
        v14,
        v15,
        Tag,
        Object,
        (SIZE_T)HandleInformation,
        v34,
        v35,
        (INT64)v36,
        (PWCHAR)v37[0]);
      v8 = 1;
      LODWORD(FullPath) = 0;
      if( *((_DWORD *)Data + 2) )
      {
        do
        {
          v16 = v7 + 12;
          v36 = 0i64;
          v17 = (char *)Data + v7;
          v38 = 0i64;
          *(_OWORD *)v37 = 0i64;
          if( v7 > v7 + 12 )
            goto LABEL_29;
          if( v3 < v16 )
            goto LABEL_29;
          v18 = *((unsigned __int16 *)v17 + 2);
          if( (v18 & 1) != 0 )
            goto LABEL_29;
          if( !(_WORD)v18 )
            goto LABEL_29;
          v19 = v18 + v16;
          if( v16 > v18 + v16 )
            goto LABEL_29;
          v20 = *((unsigned __int16 *)v17 + 3);
          if( (v20 & 1) != 0 )
            goto LABEL_29;
          if( !(_WORD)v20 )
            goto LABEL_29;
          v7 = v19 + v20;
          if( v19 > v19 + v20 )
            goto LABEL_29;
          if( v3 < v7 )
            goto LABEL_29;
          v21 = *((_DWORD *)v17 + 2);
          v38.Buffer = (wchar_t *)(v17 + 12);
          v38.MaximumLength = v18;
          v38.Length = v18;
          WORD1(v37[0]) = v20;
          LOWORD(v37[0]) = v20;
          v37[1] = &v17[2 * ((unsigned __int64)(unsigned int)v18 >> 1) + 12];
          LODWORD(v41) = *(_DWORD *)v17;
          if( (v21 & 7) != v21 )
          {
LABEL_29:
            JobSilo = -1073741811;
            goto LABEL_34;
          }
          PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x67655256ui64);
          if( !PoolWithTag )
          {
            JobSilo = -1073741670;
            goto LABEL_34;
          }
          v23 = (VOID *)v35;
          *PoolWithTag = v5;
          PoolWithTag[1] = 0i64;
          v5 = PoolWithTag;
          LODWORD(Objecta) = v41;
          LODWORD(Taga) = v21;
          JobSilo = VrpCreateNamespaceNode((INT64)v6, &v38, v23, (const VOID **)v37, Taga, (INT64)Objecta, &v36);
          if( JobSilo < 0 )
            goto LABEL_34;
          v24 = (_DWORD)FullPath + 1;
          v3 = v39;
          v5[1] = v36;
          LODWORD(FullPath) = v24;
        }
        while( v24 < *((_DWORD *)Data + 2) );
      }
      for( i = v5; i; i = (_QWORD *)*i )
      {
        JobSilo = VrpAddNamespaceNodeToList(v6, (UNICODE_STRING *)i[1]);
        if( JobSilo < 0 )
          goto LABEL_34;
      }
      for( j = v5; j; j = (_QWORD *)*j )
      {
        JobSilo = VrpCreateNamespaceNodePlaceholderKey(j[1]);
        if( JobSilo < 0 )
          goto LABEL_34;
      }
      JobSilo = 0;
      goto LABEL_34;
    }
    v6 = (UINT64 *)FullPath;
    JobSilo = -1073741811;
    v10 = (unsigned int)v11;
  }
  else
  {
    JobSilo = -1073741811;
    v10 = 0i64;
  }
  while( v10 )
  {
    if( JobSilo < 0 )
    {
      v27 = *(_QWORD *)(v10 + 8);
      if( v27 )
        VrpDestroyNamespaceNode(v6, v27);
    }
    ExFreePoolWithTag((PVOID)v10, 0x67655256u);
LABEL_34:
    v10 = (unsigned __int64)v5;
    if( v5 )
      v5 = (_QWORD *)*v5;
  }
  if( v8 )
    VrpUnlockJobContextExclusive((INT64)v6);
  if( v42 )
    ObfDereferenceObjectWithTag(v42, 0x52566D43ui64);
  return(unsigned int)JobSilo;
}

Referenced by: