PoStoreRequester

NTSTATUS __stdcall PoStoreRequester(
        _DIAGNOSTIC_CONTEXT *Requester,
        _DIAGNOSTIC_BUFFER *StoredRequester,
        UINT64 *BufferSizePointer,
        UINT8 ShortName){
  UINT64 v4; 
  unsigned __int64 v6; 
  char v7; 
  unsigned __int16 *v8; 
  _DIAGNOSTIC_BUFFER *v9; 
  char v10; 
  _OBJECT_NAME_INFORMATION *ImageFileName; 
  __int64 v12; 
  char *v13; 
  char *i; 
  char *v15; 
  unsigned __int64 v16; 
  _DEVICE_OBJECT *DeviceObject; 
  _DEVICE_OBJECT *DeviceAttachmentBaseRefWithTag; 
  _DEVICE_OBJECT *v20; 
  NTSTATUS DeviceProperty; 
  _UNICODE_STRING *p_DriverName; 
  unsigned int v23; 
  __int64 v24; 
  unsigned __int16 *DeviceNode; 
  UINT64 v26; 
  UINT64 ResultLength; 
  UINT64 *v28; 

  v28 = BufferSizePointer;
  v4 = *BufferSizePointer;
  LODWORD(ResultLength) = 0;
  v6 = 40i64;
  v7 = 0;
  v8 = 0i64;
  v9 = 0i64;
  if( StoredRequester && v4 >= 0x28 )
  {
    v9 = StoredRequester + 1;
    StoredRequester->CallerType = Requester->CallerType;
    v10 = 1;
  }
  else
  {
    v10 = 0;
  }
  if( Requester->CallerType )
  {
    if( v10 )
    {
      StoredRequester->ProcessId = (unsigned int)Requester->Process->UniqueProcessId;
      StoredRequester->ServiceTag = Requester->ServiceTag;
    }
    ImageFileName = Requester->Process->SeAuditProcessCreationInfo.ImageFileName;
    v12 = *(_WORD *)ImageFileName;
    v13 = (char *)*((_QWORD *)ImageFileName + 1);
    LODWORD(ResultLength) = *(_WORD *)ImageFileName;
    if( ShortName )
    {
      for( i = &v13[2 * ((unsigned __int64)(unsigned int)v12 >> 1)]; i != v13 && *(_WORD *)i != 92; i -= 2 )
        ;
      if( i != v13 )
      {
        v15 = i + 2;
        v12 = (unsigned int)((_DWORD)v13 - (_DWORD)v15 + v12);
        v13 = v15;
        LODWORD(ResultLength) = v12;
      }
    }
    v16 = (unsigned int)v12;
    v6 = v12 + 42;
    if( v10 && v4 >= v6 )
    {
      v10 = 1;
      memmove(v9, v13, v12);
      *((_WORD *)&v9->Size + (v16 >> 1)) = 0;
      StoredRequester->ProcessImageNameOffset = (char *)v9 - (char *)StoredRequester;
    }
    else
    {
      v10 = 0;
    }
  }
  else
  {
    DeviceObject = Requester->DeviceObject;
    if( DeviceObject )
    {
      DeviceAttachmentBaseRefWithTag = IoGetDeviceAttachmentBaseRefWithTag(DeviceObject, 0x67446F50ui64);
      v20 = DeviceAttachmentBaseRefWithTag;
      if( DeviceAttachmentBaseRefWithTag )
      {
        if( DeviceAttachmentBaseRefWithTag->DeviceObjectExtension->DeviceNode )
        {
          if( v10 )
          {
            DeviceProperty = IoGetDeviceProperty(
                               DeviceAttachmentBaseRefWithTag,
                               0,
                               (unsigned int)(v4 - 40),
                               v9,
                               &ResultLength);
          }
          else
          {
            DeviceProperty = IoGetDeviceProperty(DeviceAttachmentBaseRefWithTag, 0, 0i64, 0i64, &ResultLength);
            if( DeviceProperty == -1073741789 )
              DeviceProperty = 0;
          }
        }
        else
        {
          DeviceProperty = -1073741808;
        }
        if( DeviceProperty < 0 )
        {
          p_DriverName = &v20->DriverObject->DriverName;
          v23 = p_DriverName->Length + 2;
          LODWORD(ResultLength) = v23;
          if( v10 && v4 >= (unsigned __int64)v23 + 40 )
          {
            v10 = 1;
            RtlStringCbCopyUnicodeString((CHAR *)v9, v23, p_DriverName);
          }
          else
          {
            v10 = 0;
          }
        }
        v24 = (unsigned int)ResultLength;
        v6 = (unsigned int)ResultLength + 40i64;
        if( v10 )
        {
          v7 = 1;
          StoredRequester->ProcessImageNameOffset = (char *)v9 - (char *)StoredRequester;
          v9 = (_DIAGNOSTIC_BUFFER *)((char *)v9 + v24);
        }
        DeviceNode = (unsigned __int16 *)v20->DeviceObjectExtension->DeviceNode;
        if( DeviceNode )
        {
          v8 = DeviceNode + 20;
          v26 = (unsigned int)DeviceNode[20] + 2;
          v6 += v26;
          LODWORD(ResultLength) = DeviceNode[20] + 2;
          if( v10 && v4 >= v6 )
          {
            v10 = 1;
            RtlStringCbCopyUnicodeString((CHAR *)v9, v26, (_UNICODE_STRING *)(DeviceNode + 20));
            StoredRequester->DevicePathOffset = (char *)v9 - (char *)StoredRequester;
          }
          else
          {
            v10 = 0;
          }
        }
        ObfDereferenceObjectWithTag(v20, 0x67446F50ui64);
      }
    }
  }
  *v28 = v6;
  if( !v10 )
    return -1073741789;
  if( StoredRequester->CallerType == KernelRequester )
  {
    if( !v7 )
      StoredRequester->ProcessImageNameOffset = 0i64;
    if( !v8 )
      StoredRequester->DevicePathOffset = 0i64;
  }
  return 0;
}

Referenced by: