VrpTranslatePath

NTSTATUS __stdcall VrpTranslatePath(
        _UNICODE_STRING *AbsolutePath,
        _UNICODE_STRING *NewKeyPath,
        _UNICODE_STRING *NewRemainingPath,
        VOID **NewRootObject,
        _VRP_JOB_CONTEXT *JobContext){
  int Length; 
  _UNICODE_STRING *v6; 
  _EX_PUSH_LOCK *v7; 
  int v8; 
  _UNICODE_STRING v9; 
  _ETHREAD *CurrentThread; 
  _UNICODE_STRING *NamespaceNode; 
  INT64 v12; 
  UINT64 v13; 
  wchar_t *Buffer; 
  __int64 v15; 
  WCHAR v16; 
  int v17; 
  _UNICODE_STRING v18; 
  INT64 v19; 
  int v20; 
  int v21; 
  int v22; 
  int v23; 
  _EX_PUSH_LOCK *v24; 
  int v25; 
  int v26; 
  void *v27; 
  __int64 v28; 
  wchar_t *v29; 
  unsigned __int16 v30; 
  unsigned __int64 i; 
  __int64 v32; 
  __int16 v33; 
  INT64 v35; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  UINT64 Position; 
  INT64 Path; 
  _UNICODE_STRING Path_8; 
  VOID *PathToken[3]; 
  INT64 v41; 
  PVOID v42; 
  _UNICODE_STRING NewPath; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  int v47; 
  _QWORD *v49; 
  __int64 v50; 
  int *v51; 
  _DWORD *v52; 

  v41 = 0i64;
  Length = NewRemainingPath[2].Length;
  v6 = AbsolutePath;
  v7 = (_EX_PUSH_LOCK *)AbsolutePath;
  v8 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  memset(PathToken, 0, sizeof(PathToken));
  v47 = Length;
  LOBYTE(Path) = 0;
  v9 = *(_UNICODE_STRING *)NewRootObject;
  NewPath = 0i64;
  Path_8 = v9;
  while( 1 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockSharedEx(v7 + 2, 0i64);
    NamespaceNode = VrpFindNamespaceNode((unsigned __int64 *)v7, &Path_8, 1, 0i64, (UINT64 *)&v41);
    if( !NamespaceNode )
      break;
    v12 = v41;
    v13 = 0i64;
    Position = 0i64;
    if( v41 )
    {
      do
      {
        VrpGetNextToken(&Path_8, &Position, (_UNICODE_STRING *)&PathToken[1]);
        --v12;
      }
      while( v12 );
      v13 = Position;
    }
    Buffer = Path_8.Buffer;
    v15 = (unsigned __int16)(Path_8.Length - 2 * v13);
    PathToken[2] = &Path_8.Buffer[v13];
    LOWORD(PathToken[1]) = Path_8.Length - 2 * v13;
    WORD1(PathToken[1]) = PathToken[1];
    v17 = VrpBuildKeyPath((_UNICODE_STRING *)((char *)NamespaceNode + 24), (_UNICODE_STRING *)&PathToken[1], &NewPath);
    if( v17 < 0 )
      goto LABEL_29;
    VrpStripTrailingCharacters(&NewPath, v16);
    if( Buffer != NewRootObject[1] )
      ExFreePoolWithTag(Buffer, 0);
    v18 = NewPath;
    Path_8 = NewPath;
    RtlInitUnicodeString(&NewPath, 0i64);
    v20 = (int)NamespaceNode[3].Buffer;
    v21 = v20 & 4 | v8;
    if( v7 == (_EX_PUSH_LOCK *)AbsolutePath )
      v21 |= v20 & 2;
    v22 = NamespaceNode[4].Length;
    v23 = v21 | 0x20000000;
    v24 = *(_EX_PUSH_LOCK **)&NamespaceNode[1].Length;
    if( (_WORD)v15 )
      v23 = v21;
    v25 = (unsigned __int8)Path;
    v8 = v23;
    if( v47 < v22 )
      v25 = 1;
    v26 = NamespaceNode[4].MaximumLength - v22 + v47;
    LODWORD(Path) = v25;
    v47 = v26;
    if( !v24 )
    {
      if( v49 )
      {
        if( !(_BYTE)v25 )
        {
          ObfReferenceObject(NewKeyPath);
          v27 = NewKeyPath;
          goto LABEL_19;
        }
        ObjectAttributes.Length = 48;
        ObjectAttributes.ObjectName = (_UNICODE_STRING *)((char *)NamespaceNode + 24);
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v17 = ZwOpenKey(
                PathToken,
                0x80000000ui64,
                &ObjectAttributes,
                v19,
                v35,
                (INT64)HandleInformation,
                Position,
                Path);
        if( v17 < 0
          || (v42 = 0i64,
              v17 = ObReferenceObjectByHandle(PathToken[0], 0i64, (_OBJECT_TYPE *)CmKeyObjectType, 0, &v42, 0i64),
              v27 = v42,
              v17 < 0) )
        {
LABEL_29:
          v6 = AbsolutePath;
          goto LABEL_30;
        }
LABEL_19:
        v26 = v47;
        *v49 = v27;
      }
      v28 = v50;
      if( v50 )
      {
        v29 = Path_8.Buffer;
        v30 = Path_8.Length;
        if( (_BYTE)v25 )
        {
          for( i = (unsigned __int64)LOWORD(NamespaceNode[1].Buffer) >> 1; ; ++i )
          {
            Position = i;
            if( 2 * i >= Path_8.Length || Path_8.Buffer[i] != 92 )
              break;
          }
        }
        else
        {
          Position = 0i64;
          i = 0i64;
          v32 = 0i64;
          if( v26 > 0 )
          {
            do
            {
              VrpGetNextToken(&Path_8, &Position, (_UNICODE_STRING *)&PathToken[1]);
              ++v32;
            }
            while( (int)v32 < v47 );
            i = Position;
            v28 = v50;
            v29 = Path_8.Buffer;
          }
        }
        v33 = v30 - 2 * i;
        *(_QWORD *)(v28 + 8) = &v29[i];
        *(_WORD *)v28 = v33;
        *(_WORD *)(v28 + 2) = v33;
      }
      if( v51 )
        *v51 = v8;
      *v52 = HIDWORD(NamespaceNode[3].Buffer);
      *(_UNICODE_STRING *)JobContext = v18;
      RtlInitUnicodeString(&Path_8, 0i64);
      v17 = 0;
      goto LABEL_29;
    }
    ObfReferenceObjectWithTag(v24, 0x67655256ui64);
    if( _InterlockedCompareExchange64(&v7[2]._bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v7 + 2);
    KeAbPostRelease(&v7[2]);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    v6 = AbsolutePath;
    if( v7 != (_EX_PUSH_LOCK *)AbsolutePath )
      ObfDereferenceObjectWithTag(v7, 0x67655256ui64);
    v7 = v24;
  }
  v17 = -1073741772;
LABEL_30:
  if( _InterlockedCompareExchange64(&v7[2]._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v7 + 2);
  KeAbPostRelease(&v7[2]);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v7 && v7 != (_EX_PUSH_LOCK *)v6 )
    ObfDereferenceObjectWithTag(v7, 0x67655256ui64);
  if( Path_8.Buffer && Path_8.Buffer != NewRootObject[1] )
    ExFreePoolWithTag(Path_8.Buffer, 0);
  if( PathToken[0] )
    ZwClose((_HANDLE)PathToken[0]);
  return v17;
}

Referenced by: