ExpWnfCreateNameInstance

ntfs-wnf-7.c

__int64 __fastcall ExpWnfCreateNameInstance(unsigned __int64 ScopeInstance, unsigned __int64 statename, __int64 a3, struct _KPROCESS *a4, struct _EX_RUNDOWN_REF **a5)
{
  __int64 v5; // rax
  unsigned __int64 v7; // r15
  SIZE_T v10; // rdx
  struct _EX_RUNDOWN_REF *v11; // rax
  struct _EX_RUNDOWN_REF *nameinstance; // rdi
  struct _EX_RUNDOWN_REF *v13; // r12
  unsigned int v14; // esi
  volatile signed __int64 *v15; // rsi
  __int64 v16; // rax
  __int64 v17; // r14
  struct _EX_RUNDOWN_REF *v18; // rax
  struct _EX_RUNDOWN_REF *v19; // r14
  _QWORD *pNameSet; // rdx
  bool v21; // r8
  _QWORD *v22; // rax
  unsigned __int64 v23; // r15
  __int64 v24; // rax
  __int64 v25; // r14
  struct _EX_RUNDOWN_REF **v26; // r8
  struct _EX_RUNDOWN_REF *v27; // rdx
  SIZE_T v29; // rdx
  void *StateData; // rcx

  v5 = *(_QWORD *)(a3 + 8);
  v7 = (statename >> 4) & 3;
  if ( PsInitialSystemProcess == a4 || (_DWORD)v7 != 3 )
  {
    v10 = 0xB8i64;
    if ( !v5 )
      v10 = 0xA8i64;
    v11 = (struct _EX_RUNDOWN_REF *)ExAllocatePoolWithTag(PagedPool, v10, 0x20666E57u);
  }
  else
  {
    v29 = 0xB8i64;
    if ( !v5 )
      v29 = 0xA8i64;
    v11 = (struct _EX_RUNDOWN_REF *)ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v29, 0x20666E57u);
  }
  nameinstance = v11;