EtwpCaptureString

NTSTATUS __stdcall EtwpCaptureString(_UNICODE_STRING *UserString, _UNICODE_STRING *CapturedString){
  NTSTATUS v4; 
  char PreviousMode; 
  __int64 Length; 
  wchar_t *Buffer; 
  VOID **PoolWithTag; 
  INT8 *v9; 

  v4 = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  RtlInitUnicodeString(CapturedString, 0i64);
  if( PreviousMode )
  {
    Length = UserString->Length;
    if( (_WORD)Length )
    {
      Buffer = UserString->Buffer;
      if( ((unsigned __int8)Buffer & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)Buffer + Length > 0x7FFFFFFF0000i64 || (wchar_t *)((char *)Buffer + Length) < Buffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  PoolWithTag = ExAllocatePoolWithTag(1ui64, UserString->Length + 2i64, 1350005829i64);
  v9 = (INT8 *)PoolWithTag;
  if( !PoolWithTag
    || (memmove(PoolWithTag, UserString->Buffer, UserString->Length),
        *(_WORD *)&v9[2 * ((unsigned __int64)UserString->Length >> 1)] = 0,
        !RtlCreateUnicodeString((INT64)CapturedString, v9)) )
  {
    v4 = -1073741801;
  }
  if( v9 )
    ExFreePoolWithTag(v9, 0);
  return v4;
}

Referenced by: