ObReferenceObjectByName

NTSTATUS __fastcall ObReferenceObjectByName(
        unsigned __int64 a1,
        int a2,
        __int64 *a3,
        DWORD a4,
        __int64 a5,
        char a6,
        __int64 a7,
        PADAPTER_OBJECT *a8){
  NTSTATUS v12; 
  _EJOB *Silo; 
  unsigned __int64 v14; 
  UINT8 v15; 
  INT64 AccessMode; 
  INT64 AccessStatus; 
  PADAPTER_OBJECT DmaAdapter; 
  UNICODE_STRING CapturedObjectName; 
  INT64 v20[2]; 
  __int128 v21; 
  __int128 v22; 
  __int64 v23; 
  _OBP_LOOKUP_CONTEXT LookupContext; 
  INT64 v25[20]; 
  __int64 result[28]; 
  memset((INT64)result, 0i64);
  DmaAdapter = 0i64;
  CapturedObjectName = 0i64;
  memset((INT64)v25, 0i64);
  v23 = 0i64;
  memset(&LookupContext, 0, sizeof(LookupContext));
  *(_OWORD *)v20 = 0i64;
  v21 = 0i64;
  v22 = 0i64;
  if( !a1 )
    return -1073741773;
  v12 = ObpCaptureObjectName(a6, (UNICODE_STRING *)a1, &CapturedObjectName, 1ui64);
  LODWORD(AccessStatus) = v12;
  if( v12 < 0 )
    return v12;
  if( !CapturedObjectName.Length )
    return -1073741773;
  if( a3
    || (a3 = v25,
        LODWORD(AccessStatus) = SeCreateAccessState(
                                  (_ACCESS_STATE *)v25,
                                  (_AUX_ACCESS_DATA *)result,
                                  a4,
                                  (_GENERIC_MAPPING *)(a5 + 76)),
        (int)AccessStatus >= 0) )
  {
    Silo = PsGetCurrentSilo();
    LOBYTE(AccessMode) = a6;
    LODWORD(AccessStatus) = ObpLookupObjectName(
                              0i64,
                              &CapturedObjectName,
                              (unsigned int)a2,
                              (_OBJECT_TYPE *)a5,
                              AccessMode,
                              (VOID *)a7,
                              0i64,
                              0i64,
                              Silo,
                              (_ACCESS_STATE *)a3,
                              &LookupContext,
                              0i64,
                              (VOID **)&DmaAdapter);
    ObpReleaseLookupContext((INT64)&LookupContext);
    *a8 = 0i64;
    if( (int)AccessStatus >= 0 )
    {
      v14 = LOBYTE(DmaAdapter[-2].DmaOperations) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8);
      *(_QWORD *)&v22 = 0i64;
      *(_QWORD *)&v21 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v14] + 16;
      *((_QWORD *)&v21 + 1) = &CapturedObjectName;
      SeSetLearningModeObjectInformation((INT64)v20);
      if( ObpCheckObjectReference(DmaAdapter, (_ACCESS_STATE *)a3, v15, a6, &AccessStatus) )
        *a8 = DmaAdapter;
      else
        HalPutDmaAdapter(DmaAdapter);
      SeClearLearningModeObjectInformation();
    }
    if( a3 == v25 )
    {
      SepDeleteAccessState((ACCESS_STATE *)a3);
      SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)a3 + 1);
    }
  }
  ObpFreeObjectNameBuffer(&CapturedObjectName);
  return AccessStatus;
}

Referenced by: