IopSymlinkProcessReparse

VOID __stdcall IopSymlinkProcessReparse(
        IRP *Irp,
        FILE_OBJECT *FileObject,
        REPARSE_DATA_BUFFER *ReparseBuffer,
        UINT8 StopOnSymlink){
  unsigned __int64 v4; 
  __int64 v7; 
  _ECP_LIST *v8; 
  int ECP; 
  UNICODE_STRING *MostRecentlyUsedName; 
  INT16 MatchingComponentsLengthR; 
  INT64 v12; 
  v4 = *((_QWORD *)Irp + 7);
  if( v4 - 2684354563u <= 0x16 && (v7 = 4194817i64, _bittest64(&v7, v4 - 2684354563u)) )
  {
    if( !StopOnSymlink )
      IopGraftName(Irp, FileObject, ReparseBuffer);
  }
  else if( v4 > 2 )
  {
    v8 = (_ECP_LIST *)*((_QWORD *)Irp + 14);
    v12 = 0i64;
    ECP = IopSymlinkGetECP(v8, (_RELATIVE_SYMLINK_INFO **)&v12);
    if( ECP < 0
      || (MostRecentlyUsedName = (UNICODE_STRING *)IopSymlinkGetMostRecentlyUsedName(v12),
          MatchingComponentsLengthR = IopFindMatchingComponentsLengthR(&FileObject->FileName, MostRecentlyUsedName + 1),
          ECP = IopSymlinkRememberJunction(MatchingComponentsLengthR, FileObject, (INT64)Irp, (UNICODE_STRING *)v12),
          ECP < 0) )
    {
      *((_DWORD *)Irp + 12) = ECP;
    }
  }
}

Referenced by: