ObpInitializeRootNamespace

NTSTATUS __stdcall ObpInitializeRootNamespace(_EJOB *Silo, PVOID RootDirectory, PVOID DosDevicesShadowDirectory){
  UINT8 IsHostSilo; 
  NTSTATUS KernelObjectsSD; 
  bool v7; 
  PVOID *Object; 
  HANDLE Handle; 
  HANDLE DirectoryHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID v13; 
  __int128 SecurityDescriptor[2]; 
  __int64 v15; 
  Handle = 0i64;
  DirectoryHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  IsHostSilo = PsIsHostSilo(Silo);
  v15 = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  KernelObjectsSD = ObCreateKernelObjectsSD(SecurityDescriptor);
  if( KernelObjectsSD >= 0 )
  {
    if( IsHostSilo
      || (ObjectAttributes.RootDirectory = 0i64,
          ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpKernelObjectsPathString,
          ObjectAttributes.Length = 48,
          ObjectAttributes.Attributes = 592,
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64,
          KernelObjectsSD = ZwOpenDirectoryObject(&DirectoryHandle, 0xF000Fui64, &ObjectAttributes),
          KernelObjectsSD >= 0) )
    {
      ObjectAttributes.SecurityQualityOfService = 0i64;
      LODWORD(Object) = 0;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&ObpKernelObjectsNameString;
      ObjectAttributes.Length = 48;
      ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
      ObjectAttributes.RootDirectory = RootDirectory;
      ObjectAttributes.Attributes = 592;
      KernelObjectsSD = ZwCreateDirectoryObjectEx(
                          &Handle,
                          0xF000Fui64,
                          &ObjectAttributes,
                          DirectoryHandle,
                          (UINT64)Object);
      if( KernelObjectsSD >= 0 )
      {
        ZwClose(Handle);
        Handle = 0i64;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)ObpObjectTypesNameString;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = RootDirectory;
        ObjectAttributes.Attributes = 592;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        if( IsHostSilo )
        {
          KernelObjectsSD = ZwCreateDirectoryObject(&Handle, 0xF000Fui64, &ObjectAttributes);
          if( KernelObjectsSD < 0 )
            goto LABEL_9;
          v13 = 0i64;
          KernelObjectsSD = ObReferenceObjectByHandle(Handle, 0, ObpDirectoryObjectType, 0, &v13, 0i64);
          ObpTypeDirectoryObject = (PADAPTER_OBJECT)v13;
          v7 = KernelObjectsSD < 0;
        }
        else
        {
          KernelObjectsSD = ZwCreateSymbolicLinkObject(
                              &Handle,
                              0xF0001ui64,
                              &ObjectAttributes,
                              (UNICODE_STRING *)&ObpObjectTypesPathString);
          if( KernelObjectsSD < 0 )
            goto LABEL_9;
          KernelObjectsSD = ZwSetInformationSymbolicLink((INT64)Handle);
          v7 = KernelObjectsSD < 0;
        }
        if( !v7 )
          KernelObjectsSD = ObpCreateDosDevicesDirectory(Silo, RootDirectory);
      }
    }
  }
LABEL_9:
  if( Handle )
    ZwClose(Handle);
  if( DirectoryHandle )
    ZwClose(DirectoryHandle);
  ObCleanupSecurityDescriptor(SecurityDescriptor);
  return KernelObjectsSD;
}

Referenced by: