SmKmEtwAppendObjectName

__int64 __fastcall SmKmEtwAppendObjectName(__int64 a1, _DEVICE_OBJECT *DeviceAttachmentBaseRefWithTag){
  unsigned int v2; 
  unsigned int v4; 
  __int64 v6; 
  VOID *v7; 
  unsigned __int64 v8; 
  unsigned int v9; 
  _DEVICE_OBJECT *v10; 
  char v11; 
  char v12; 
  INT16 v13; 
  NTSTATUS v14; 
  __int128 *v15; 
  unsigned __int16 v16; 
  unsigned __int16 *v17; 
  unsigned int v18; 
  unsigned __int16 **v19; 
  __int64 v20; 
  __int64 result; 
  _QWORD *v22; 
  UINT64 ReturnLength; 
  __int128 Src[2]; 

  v2 = *(_DWORD *)(a1 + 24);
  v4 = *(_DWORD *)(a1 + 28) - v2;
  LODWORD(ReturnLength) = 0;
  v6 = *(_QWORD *)(a1 + 8) + v2;
  Src[0] = *(_OWORD *)L"\\Device\\Unknown";
  Src[1] = *(_OWORD *)L"Unknown";
  v7 = (VOID *)(v6 + 2);
  v8 = (v6 + 9) & 0xFFFFFFFFFFFFFFF8ui64;
  v9 = v6 + v4 - v8;
  *(_QWORD *)v8 = 0i64;
  *(_QWORD *)(v8 + 8) = 0i64;
  if( ((unsigned __int8)DeviceAttachmentBaseRefWithTag & 1) != 0 )
  {
    DeviceAttachmentBaseRefWithTag = IoGetDeviceAttachmentBaseRefWithTag(
                                       (_DEVICE_OBJECT *)((unsigned __int64)DeviceAttachmentBaseRefWithTag & 0xFFFFFFFFFFFFFFFEui64),
                                       0x746C6644ui64);
    v10 = DeviceAttachmentBaseRefWithTag;
  }
  else
  {
    v10 = 0i64;
  }
  if( DeviceAttachmentBaseRefWithTag )
  {
    IoSetThreadHardErrorMode(0);
    v12 = v11;
    v14 = ObQueryNameString(DeviceAttachmentBaseRefWithTag, (_OBJECT_NAME_INFORMATION *)v8, v9, &ReturnLength);
    if( v10 )
      ObfDereferenceObjectWithTag(v10, 0x746C6644ui64);
    LOBYTE(v13) = v12;
    IoSetThreadHardErrorMode(v13);
  }
  else
  {
    v14 = -1073741809;
  }
  if( v14 >= 0 && *(_WORD *)v8 )
  {
    v15 = *(__int128 **)(v8 + 8);
    v16 = *(_WORD *)v8 >> 1;
  }
  else
  {
    v15 = Src;
    v16 = 15;
  }
  memmove(v7, v15, 2 * v16);
  v17 = (unsigned __int16 *)(*(_QWORD *)(a1 + 8) + *(unsigned int *)(a1 + 24));
  v18 = 2 * v16;
  *v17 = v16;
  v19 = (unsigned __int16 **)(*(_QWORD *)a1 + 16i64 * *(unsigned int *)(a1 + 16));
  *v19 = v17;
  v19[1] = (unsigned __int16 *)2;
  v20 = (unsigned int)++*(_DWORD *)(a1 + 16);
  *(_DWORD *)(a1 + 24) += 2;
  result = *(_QWORD *)(a1 + 8) + *(unsigned int *)(a1 + 24);
  v22 = (_QWORD *)(*(_QWORD *)a1 + 16 * v20);
  *v22 = result;
  v22[1] = v18;
  ++*(_DWORD *)(a1 + 16);
  *(_DWORD *)(a1 + 24) += v18;
  return result;
}

Referenced by: