WmipProbeAndCaptureGuidObjectAttributes

NTSTATUS __stdcall WmipProbeAndCaptureGuidObjectAttributes(
        _OBJECT_ATTRIBUTES *CapturedObjectAttributes,
        _UNICODE_STRING *CapturedGuidString,
        WCHAR *CapturedGuuffer,
        _OBJECT_ATTRIBUTES *ObjectAttributes){
  NTSTATUS v8; 
  __int64 v9; 
  unsigned __int64 ObjectName; 
  unsigned __int16 Length; 
  wchar_t *Buffer; 
  unsigned __int64 RootDirectory_low; 
  _UNICODE_STRING v15; 

  v8 = 0;
  if( IoIs32bitProcess(0i64) )
  {
    if( ((unsigned __int8)ObjectAttributes & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( (unsigned __int64)&ObjectAttributes->Attributes > 0x7FFFFFFF0000i64
      || &ObjectAttributes->Attributes < (unsigned int *)ObjectAttributes )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
    CapturedObjectAttributes->Length = 48;
    CapturedObjectAttributes->RootDirectory = (void *)*(&ObjectAttributes->Length + 1);
    CapturedObjectAttributes->Attributes = HIDWORD(ObjectAttributes->RootDirectory);
    CapturedObjectAttributes->SecurityDescriptor = (void *)LODWORD(ObjectAttributes->ObjectName);
    CapturedObjectAttributes->SecurityQualityOfService = (void *)HIDWORD(ObjectAttributes->ObjectName);
    RootDirectory_low = LODWORD(ObjectAttributes->RootDirectory);
    if( !LODWORD(ObjectAttributes->RootDirectory) )
      return -1073741811;
    if( (RootDirectory_low & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    if( RootDirectory_low + 8 < RootDirectory_low )
      MEMORY[0x7FFFFFFF0000] = 0;
    CapturedGuidString->Length = *(_WORD *)RootDirectory_low;
    CapturedGuidString->MaximumLength = *(_WORD *)(RootDirectory_low + 2);
    CapturedGuidString->Buffer = (wchar_t *)*(unsigned int *)(RootDirectory_low + 4);
  }
  else
  {
    v9 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)ObjectAttributes < 0x7FFFFFFF0000i64 )
      v9 = (__int64)ObjectAttributes;
    *(_OWORD *)&CapturedObjectAttributes->Length = *(_OWORD *)v9;
    *(_OWORD *)&CapturedObjectAttributes->ObjectName = *(_OWORD *)(v9 + 16);
    *(_OWORD *)&CapturedObjectAttributes->SecurityDescriptor = *(_OWORD *)(v9 + 32);
    ObjectName = (unsigned __int64)CapturedObjectAttributes->ObjectName;
    if( !ObjectName )
      return -1073741811;
    *(_DWORD *)(&v15.MaximumLength + 1) = 0;
    if( ObjectName >= 0x7FFFFFFF0000i64 )
      ObjectName = 0x7FFFFFFF0000i64;
    *(_DWORD *)&v15.Length = *(_DWORD *)ObjectName;
    v15.Buffer = *(wchar_t **)(ObjectName + 8);
    *CapturedGuidString = v15;
  }
  if( CapturedObjectAttributes->SecurityDescriptor || CapturedObjectAttributes->SecurityQualityOfService )
    return -1073741811;
  Length = 90;
  if( CapturedGuidString->Length != 90 )
    return -1073741811;
  Buffer = CapturedGuidString->Buffer;
  if( (unsigned __int64)(Buffer + 45) > 0x7FFFFFFF0000i64 || Buffer + 45 < Buffer )
  {
    MEMORY[0x7FFFFFFF0000] = 0;
    Length = CapturedGuidString->Length;
    Buffer = CapturedGuidString->Buffer;
  }
  memmove(CapturedGuuffer, Buffer, Length);
  CapturedGuuffer[45] = 0;
  CapturedGuidString->Buffer = CapturedGuuffer;
  CapturedObjectAttributes->ObjectName = CapturedGuidString;
  return v8;
}

Referenced by: