ObpLookupDirectoryEntryEx
VOID *__fastcall ObpLookupDirectoryEntryEx(
CHAR *DmaAdapter,
const UNICODE_STRING *a2,
CHAR a3,
CHAR a4,
CHAR a5,
INT64 a6){
wchar_t *Buffer;
CHAR v7;
bool v9;
unsigned int v10;
unsigned __int64 v12;
unsigned int v13;
int v14;
unsigned int v15;
int v16;
INT64 v17;
VOID *v18;
__int64 v20;
__int64 v21;
__int128 v22;
_OBJECT_DIRECTORY *ShadowDirectory;
INT64 v24;
Buffer = a2->Buffer;
v7 = a4;
v9 = (a3 & 0x40) != 0;
v10 = a2->Length >> 1;
if( v10 < 4 )
{
v13 = 0;
}
else
{
v12 = 0i64;
do
{
*(_QWORD *)&a4 = *(_QWORD *)Buffer;
if( (*(_QWORD *)Buffer & 0xFF80FF80FF80FF80ui64) != 0 )
{
v20 = 4i64;
do
{
v21 = (unsigned __int16)a4;
if( (unsigned __int16)a4 >= 0x61u )
{
if( (unsigned __int16)a4 <= 0x7Au )
v21 = (unsigned int)(unsigned __int16)a4 - 32;
else
v21 = NLS_UPCASE(a4);
}
*(_QWORD *)&v22 = a4;
*((_QWORD *)&v22 + 1) = v21;
*(_QWORD *)&a4 = v22 >> 16;
--v20;
}
while( v20 );
}
else
{
*(_QWORD *)&a4 = a4 & 0xFFDFFFDFFFDFFFDFui64;
}
Buffer += 4;
v10 -= 4;
v12 = a4 + (v12 >> 1) + 3 * v12;
}
while( v10 >= 4 );
v13 = v12 + HIDWORD(v12);
}
while( v10 )
{
v15 = *Buffer;
v16 = (v13 >> 1) + 3 * v13;
++Buffer;
--v10;
if( v15 < 0x61 )
goto LABEL_12;
if( v15 > 0x7A )
{
*(_QWORD *)&a4 = NLS_UPCASE(v15);
v13 = a4 + v14;
}
else
{
v16 -= 32;
LABEL_12:
v13 = v15 + v16;
}
}
LOBYTE(v17) = v9;
*(_DWORD *)(a6 + 24) = v13;
*(_WORD *)(a6 + 28) = v13 % 0x25;
v18 = ObpLookupDirectoryUsingHash(
(_OBJECT_DIRECTORY *)DmaAdapter,
(_UNICODE_STRING *)a2,
(_OBP_LOOKUP_CONTEXT *)a6,
v17);
if( !v18 && v7 )
{
do
{
ShadowDirectory = (_OBJECT_DIRECTORY *)ObpGetShadowDirectory((INT64)DmaAdapter, a5);
if( ShadowDirectory )
{
if( *(_BYTE *)(a6 + 30) )
{
ObfReferenceObject(DmaAdapter);
ObpUnlockDirectory((INT64)DmaAdapter, a6);
ObpLockDirectoryShared((_OBP_LOOKUP_CONTEXT *)a6, ShadowDirectory);
HalPutDmaAdapter((PADAPTER_OBJECT)DmaAdapter);
}
LOBYTE(v24) = v9;
v18 = ObpLookupDirectoryUsingHash(ShadowDirectory, (_UNICODE_STRING *)a2, (_OBP_LOOKUP_CONTEXT *)a6, v24);
}
DmaAdapter = (CHAR *)ShadowDirectory;
}
while( !v18 && ShadowDirectory );
}
return v18;
}Referenced by:
ObCloseHandleTableEntry
ObCreateObjectTypeEx
ObpCreateSymbolicLinkName
ObpDeleteNameCheck
ObpLookupDirectoryEntry