ObReferenceObjectByName

NTSTATUS __stdcall ObReferenceObjectByName(
        _UNICODE_STRING *ObjectName,
        UINT64 Attributes,
        _ACCESS_STATE *AccessState,
        UINT64 DesiredAccess,
        _OBJECT_TYPE *ObjectType,
        INT8 AccessMode,
        VOID *ParseContext,
        VOID **Object){
  unsigned int v9; 
  unsigned int v11; 
  NTSTATUS result; 
  _EJOB *Silo; 
  unsigned __int64 v14; 
  INT64 *v15; 
  CHAR v16; 
  int v17; 
  PADAPTER_OBJECT DmaAdapter; 
  _UNICODE_STRING CapturedObjectName; 
  _LEARNING_MODE_OBJECT_INFORMATION ObjectInformation[4]; 
  __int128 v21; 
  __int128 v22; 
  __int64 v23; 
  _OBP_LOOKUP_CONTEXT LookupContext; 
  char v25[160]; 
  _AUX_ACCESS_DATA AuxData; 

  v9 = Attributes;
  v11 = DesiredAccess;
  memset(&AuxData, 0i64, sizeof(AuxData));
  DmaAdapter = 0i64;
  CapturedObjectName = 0i64;
  memset(v25, 0i64, sizeof(v25));
  v23 = 0i64;
  memset(&LookupContext, 0, sizeof(LookupContext));
  *(_OWORD *)ObjectInformation = 0i64;
  v21 = 0i64;
  v22 = 0i64;
  if( !ObjectName )
    return -1073741773;
  result = ObpCaptureObjectName(AccessMode, ObjectName, &CapturedObjectName, 1ui64);
  if( result < 0 )
    return result;
  if( !CapturedObjectName.Length )
    return -1073741773;
  if( AccessState
    || (AccessState = (_ACCESS_STATE *)v25,
        v17 = SeCreateAccessState((_ACCESS_STATE *)v25, &AuxData, v11, &ObjectType->TypeInfo.GenericMapping),
        v17 >= 0) )
  {
    Silo = PsGetCurrentSilo();
    v17 = ObpLookupObjectName(
            0i64,
            &CapturedObjectName,
            v9,
            ObjectType,
            AccessMode,
            ParseContext,
            0i64,
            0i64,
            Silo,
            AccessState,
            &LookupContext,
            0i64,
            (VOID **)&DmaAdapter);
    ObpReleaseLookupContext(&LookupContext);
    *Object = 0i64;
    if( v17 >= 0 )
    {
      v14 = LOBYTE(DmaAdapter[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)DmaAdapter - 48) >> 8);
      *(_QWORD *)&v22 = 0i64;
      *(_QWORD *)&v21 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ v14] + 16;
      *((_QWORD *)&v21 + 1) = &CapturedObjectName;
      SeSetLearningModeObjectInformation(ObjectInformation);
      LOBYTE(v15) = AccessMode;
      if( ObpCheckObjectReference(DmaAdapter, AccessState, v16, v15) )
        *Object = DmaAdapter;
      else
        HalPutDmaAdapter(DmaAdapter);
      SeClearLearningModeObjectInformation();
    }
    if( AccessState == (_ACCESS_STATE *)v25 )
    {
      SepDeleteAccessState(AccessState);
      SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)AccessState + 1);
    }
  }
  ObpFreeObjectNameBuffer(&CapturedObjectName);
  return v17;
}

Referenced by: