SepQueryNameString

NTSTATUS __stdcall SepQueryNameString(VOID *Object, PVOID *ObjectNameInfo){
  NTSTATUS v4; 
  int v5; 
  _OBJECT_NAME_INFORMATION *PoolWithTag; 
  UINT64 NumberOfBytes; 

  *ObjectNameInfo = 0i64;
  LODWORD(NumberOfBytes) = 0;
  v4 = ObQueryNameStringMode(Object, 0i64, 0i64, &NumberOfBytes, 0);
  v5 = v4;
  if( v4 == -1073741820 || v4 == -1073741789 )
  {
    PoolWithTag = (_OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1850697043i64);
    *ObjectNameInfo = PoolWithTag;
    if( PoolWithTag )
    {
      v5 = ObQueryNameStringMode(Object, PoolWithTag, (unsigned int)NumberOfBytes, &NumberOfBytes, 0);
      if( v5 < 0 || !*(_WORD *)*ObjectNameInfo )
      {
        ExFreePoolWithTag(*ObjectNameInfo, 0);
        *ObjectNameInfo = 0i64;
        if( v5 >= 0
          && (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)] == PsProcessType )
        {
          PsGetAllocatedFullProcessImageNameEx((_EPROCESS *)Object, (_UNICODE_STRING **)ObjectNameInfo);
        }
        return 0;
      }
    }
    else
    {
      return -1073741670;
    }
  }
  return v5;
}

Referenced by: