VrpCreateNamespaceNode

INT64 __fastcall VrpCreateNamespaceNode(
        INT64 a1,
        UNICODE_STRING *a2,
        VOID *a3,
        const VOID **a4,
        INT64 a5,
        INT64 a6,
        CHAR **a7){
  int v7; 
  int v12; 
  WCHAR v13; 
  UNICODE_STRING *v14; 
  char *PoolWithTag; 
  char *v16; 
  int v17; 
  UINT8 *v18; 
  UINT8 *v19; 
  unsigned __int16 Length; 
  UINT8 *v21; 
  UINT8 *v22; 
  __int16 v23; 
  CHAR **v24; 
  unsigned int v25; 
  UNICODE_STRING *BestMatchNamespaceNode; 
  UNICODE_STRING *v28; 
  int Buffer; 
  UINT64 v30; 
  UINT64 v31; 
  __int16 v32; 
  int v33; 
  void *v34; 
  void *v35; 
  void *v36; 
  UINT64 v37; 
  UNICODE_STRING String1; 
  UNICODE_STRING Source; 
  UINT64 Position; 
  v7 = a6;
  Source = 0i64;
  Position = 0i64;
  String1 = 0i64;
  v37 = 0i64;
  if( *(_DWORD *)(a1 + 84) )
    return(unsigned int)-1073741738;
  v12 = a5;
  if( (a5 & 0xE0000007) != (_DWORD)a5 )
    return(unsigned int)-1073741811;
  VrpStripTrailingCharacters(a2, (WCHAR)a2);
  VrpStripTrailingCharacters(v14, v13);
  VrpGetNextToken(a2, &Position, &String1);
  if( !RtlEqualUnicodeString(&String1, (UNICODE_STRING *)&VrpRegistryString, 1u) )
    return(unsigned int)-1073741811;
  VrpGetNextToken(a2, &Position, &String1);
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 0x48ui64, 0x67655256ui64);
  v16 = PoolWithTag;
  if( !PoolWithTag )
    return(unsigned int)-1073741670;
  memset((INT64)PoolWithTag, 0i64);
  *((_DWORD *)v16 + 14) = v12;
  v17 = -1;
  if( v7 )
    v17 = v7;
  *((_DWORD *)v16 + 15) = v17;
  v18 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, a2->MaximumLength, 0x67655256ui64);
  *((_QWORD *)v16 + 1) = v18;
  v19 = v18;
  if( v18
    && (Length = a2->Length,
        *((_WORD *)v16 + 1) = a2->Length,
        *(_WORD *)v16 = Length,
        memmove(v19, (UINT8 *)a2->Buffer, a2->Length),
        v21 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, *((unsigned __int16 *)a4 + 1), 0x67655256ui64),
        *((_QWORD *)v16 + 4) = v21,
        (v22 = v21) != 0i64) )
  {
    v23 = *(_WORD *)a4;
    *((_WORD *)v16 + 12) = *(_WORD *)a4;
    *((_WORD *)v16 + 13) = v23;
    memmove(v22, (UINT8 *)a4[1], *(unsigned __int16 *)a4);
    *((_WORD *)v16 + 32) = VrpCountPathComponents((UNICODE_STRING *)v16);
    *((_WORD *)v16 + 33) = VrpCountPathComponents((UNICODE_STRING *)(v16 + 24));
    VrpGetNextToken(a2, &Position, &String1);
    if( !String1.Length )
    {
LABEL_10:
      if( a3 )
        ObfReferenceObjectWithTag(a3, 0x67655256u);
      else
        a3 = 0i64;
      v24 = a7;
      v25 = 0;
      *((_QWORD *)v16 + 2) = a3;
      *v24 = v16;
      return v25;
    }
    BestMatchNamespaceNode = VrpFindBestMatchNamespaceNode((UINT64 *)a1, (UNICODE_STRING *)v16, &v37);
    v28 = BestMatchNamespaceNode;
    if( !BestMatchNamespaceNode || (Buffer = (int)BestMatchNamespaceNode[3].Buffer, (Buffer & 4) != 0) )
    {
      v25 = -1073741811;
    }
    else
    {
      v30 = v37;
      *((_DWORD *)v16 + 14) |= Buffer & 2;
      v31 = 0i64;
      Position = 0i64;
      if( v30 )
      {
        do
        {
          VrpGetNextToken((UNICODE_STRING *)v16, &Position, &String1);
          --v30;
        }
        while( v30 );
        v31 = Position;
      }
      v32 = *(_WORD *)v16;
      Source.Buffer = (wchar_t *)(*((_QWORD *)v16 + 1) + 2 * v31);
      Source.Length = v32 - 2 * v31;
      Source.MaximumLength = Source.Length;
      VrpBuildKeyPath((UNICODE_STRING *)((char *)v28 + 24), &Source, (UNICODE_STRING *)(v16 + 40));
      v25 = v33;
      if( v33 >= 0 )
        goto LABEL_10;
    }
  }
  else
  {
    v25 = -1073741670;
  }
  v34 = (void *)*((_QWORD *)v16 + 1);
  if( v34 )
    ExFreePoolWithTag(v34, 0x67655256u);
  v35 = (void *)*((_QWORD *)v16 + 4);
  if( v35 )
    ExFreePoolWithTag(v35, 0x67655256u);
  v36 = (void *)*((_QWORD *)v16 + 6);
  if( v36 )
    ExFreePoolWithTag(v36, 0x67655256u);
  ExFreePoolWithTag(v16, 0x67655256u);
  return v25;
}

Referenced by: