ObGetObjectInformation
INT64 __fastcall ObGetObjectInformation(INT64 a1, INT64 a2, UINT64 a3, UINT64 *a4){
INT64 v4;
unsigned int *v5;
OBJECT_NAME_INFORMATION *PoolWithTag;
OBJECT_NAME_INFORMATION *v7;
OBJECT_NAME_INFORMATION *v9;
unsigned int v10;
unsigned int v11;
__int64 v12;
unsigned int *v13;
unsigned int v14;
struct _DMA_ADAPTER *v15;
__int64 v16;
wchar_t *Mode;
char v18;
unsigned int i;
__int64 v20;
INT64 v21;
VOID *v22;
INT64 v23;
__int64 v24;
int v25;
unsigned int v26;
__int64 v27;
unsigned int v28;
int *v29;
int DmaOperations;
int DmaOperations_high;
__int64 *v32;
unsigned int v33;
__int64 v34;
__int64 v35;
__int64 v36;
int v37;
int v38;
unsigned int v39;
UINT8 *v40;
OBJECT_NAME_INFORMATION *v41;
unsigned __int16 v42;
__int16 v43;
UINT64 NumberOfBytes;
char v45;
unsigned int v46;
int v47;
unsigned int v48;
OBJECT_NAME_INFORMATION *v49;
unsigned int v50;
__int64 v51;
UINT64 Length;
__int64 v53;
OBJECT_NAME_INFORMATION *v54;
struct _DMA_ADAPTER *v55;
unsigned int *v56;
__int64 v57;
VOID *Object;
INT64 v59;
INT64 v60;
OBJECT_NAME_INFORMATION *v61;
unsigned int SourceString;
SourceString = a3;
LODWORD(NumberOfBytes) = 0;
v4 = 0i64;
v5 = 0i64;
v53 = 0i64;
Length = 536i64;
PoolWithTag = (OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(PagedPool, 0x218ui64, 0x7241624Fui64);
v7 = PoolWithTag;
v54 = PoolWithTag;
if( !PoolWithTag )
return 3221225626i64;
v9 = PoolWithTag;
v49 = PoolWithTag;
v10 = 0;
v11 = 0;
v51 = 0i64;
ObpCreateTypeArray();
v13 = (unsigned int *)v12;
v56 = (unsigned int *)v12;
if( !v12 )
{
ExFreePoolWithTag(v7, 0x7241624Fu);
return 3221225473i64;
}
v14 = 0;
LABEL_6:
v48 = v14;
if( v14 < *v13 )
{
v15 = *(struct _DMA_ADAPTER **)&v13[2 * v14 + 2];
if( !v15 )
goto LABEL_22;
v55 = v15 + 5;
if( &v15[5] == ObpTypeObjectType )
goto LABEL_22;
ObpCreateTypeArray();
v5 = (unsigned int *)v16;
v53 = v16;
LODWORD(Mode) = 0;
if( !v16 )
goto LABEL_21;
v18 = 1;
v45 = 1;
for( i = 0; ; ++i )
{
v50 = i;
if( i >= *v5 )
{
LABEL_20:
ObpDestroyTypeArray(v5);
v5 = 0i64;
v53 = 0i64;
v13 = v56;
LABEL_21:
v14 = v48;
LABEL_22:
++v14;
goto LABEL_6;
}
v20 = *(_QWORD *)&v5[2 * i + 2];
v57 = v20;
if( v20 )
break;
LABEL_71:
;
}
v21 = v20 + 32;
v22 = (VOID *)(v20 + 80);
Object = (VOID *)(v20 + 80);
if( v18 )
{
v45 = (char)Mode;
if( v51 && v11 < SourceString )
*(_DWORD *)v51 = v11;
v23 = a2 + v11;
v51 = v23;
v59 = v23;
v11 += 48;
v46 = v11;
if( v11 < 0x30 )
goto LABEL_18;
if( v11 >= SourceString )
goto LABEL_24;
*(_DWORD *)v23 = (_DWORD)Mode;
v24 = (__int64)v55;
*(_DWORD *)(v23 + 4) = HIDWORD(v55[2].DmaOperations);
*(_DWORD *)(v23 + 8) = *(_DWORD *)(v24 + 48);
*(_DWORD *)(v23 + 12) = *(unsigned __int8 *)(v24 + 40);
*(_DWORD *)(v23 + 16) = *(_DWORD *)(v24 + 72);
*(_OWORD *)(v23 + 20) = *(_OWORD *)(v24 + 76);
*(_DWORD *)(v23 + 36) = *(_DWORD *)(v24 + 92);
*(_DWORD *)(v23 + 40) = *(_DWORD *)(v24 + 100);
*(_BYTE *)(v23 + 44) = (*(_BYTE *)(v24 + 66) & 8) != 0;
LODWORD(NumberOfBytes) = (_DWORD)Mode;
v25 = ObQueryTypeName(v22, (UNICODE_STRING *)(v23 + 48), SourceString - v11, &NumberOfBytes);
v47 = v25;
v26 = (NumberOfBytes + 7) & 0xFFFFFFF8;
LODWORD(NumberOfBytes) = v26;
LODWORD(Mode) = 0;
if( v25 < 0 )
{
v10 = v25;
HIDWORD(NumberOfBytes) = v25;
}
else
{
v27 = v51;
*(_WORD *)(v51 + 50) = v26 - 16;
*(_QWORD *)(v27 + 56) += a1 - a2;
v26 = NumberOfBytes;
}
v11 += v26;
v46 = v11;
if( v11 < v26 )
{
LABEL_18:
v10 = -1073741675;
LABEL_19:
HIDWORD(NumberOfBytes) = v10;
goto LABEL_20;
}
v20 = v57;
v28 = SourceString;
v22 = (VOID *)(v21 + 48);
}
else
{
v28 = SourceString;
if( v11 < SourceString )
*(_DWORD *)v4 = v11;
}
v4 = a2 + v11;
v60 = v4;
v11 += 64;
v46 = v11;
if( v11 < 0x40 )
goto LABEL_18;
if( v11 >= v28 )
{
LABEL_24:
v10 = -1073741820;
goto LABEL_19;
}
*(_DWORD *)v4 = (_DWORD)Mode;
*(_QWORD *)(v4 + 8) = v22;
*(_QWORD *)(v4 + 16) = *(_QWORD *)(v20 + 16);
*(_WORD *)(v4 + 24) = *(_WORD *)(v20 + 24);
*(_DWORD *)(v4 + 28) = *(_DWORD *)v21;
*(_DWORD *)(v4 + 32) = *(_DWORD *)(v21 + 8);
*(_WORD *)(v4 + 26) = *(unsigned __int8 *)(v21 + 27);
*(_QWORD *)(v4 + 56) = *(_QWORD *)(v21 + 40) & 0xFFFFFFFFFFFFFFF0ui64;
v29 = (int *)OBJECT_HEADER_TO_QUOTA_INFO(v21);
DmaOperations = (int)v55[6].DmaOperations;
DmaOperations_high = HIDWORD(v55[6].DmaOperations);
if( v29 )
{
DmaOperations = *v29;
DmaOperations_high = v29[1];
}
*(_DWORD *)(v4 + 36) = DmaOperations;
*(_DWORD *)(v4 + 40) = DmaOperations_high;
v32 = (__int64 *)OBJECT_HEADER_TO_PROCESS_INFO(v21);
if( v32 )
{
v36 = *v32;
if( v36 )
*(_QWORD *)(v4 + 48) = *(_QWORD *)(v36 + 1088);
}
LODWORD(NumberOfBytes) = (_DWORD)Mode;
v37 = (int)Mode;
v47 = (int)Mode;
if( *(wchar_t **)(v34 + 160) != Mode && (POBJECT_TYPE *)v34 == IoFileObjectType )
{
*v9 = *(OBJECT_NAME_INFORMATION *)(v35 + 88);
v38 = v9->Name.Length;
if( (_WORD)v38 && v9->Name.Buffer != Mode )
{
v39 = v38 + 2;
LODWORD(NumberOfBytes) = v39;
if( v39 > 0x208 )
{
LODWORD(NumberOfBytes) = 520;
v9->Name.Length = 518;
v39 = NumberOfBytes;
}
v40 = (UINT8 *)&v9[1];
memmove(v40, (UINT8 *)v49->Name.Buffer, v39 - 2i64);
v49->Name.Buffer = (wchar_t *)v40;
v9 = v49;
v49->Name.MaximumLength = NumberOfBytes;
LODWORD(Mode) = 0;
v9->Name.Buffer[v9->Name.Length >> 1] = 0;
LODWORD(NumberOfBytes) = NumberOfBytes + 16;
v33 = SourceString;
}
LABEL_53:
if( (_DWORD)NumberOfBytes )
{
LODWORD(NumberOfBytes) = (NumberOfBytes + 7) & 0xFFFFFFF8;
v11 += NumberOfBytes;
v46 = v11;
if( v11 < (unsigned int)NumberOfBytes )
goto LABEL_18;
if( v37 < 0 )
{
v11 += 16;
v46 = v11;
if( v11 < 0x10 )
goto LABEL_18;
if( v11 < v33 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v4 + 64), 0i64, v33);
v10 = v37;
HIDWORD(NumberOfBytes) = v37;
goto LABEL_69;
}
}
else
{
v42 = v9->Name.Length;
if( v9->Name.Length && v11 < v33 )
{
v43 = v42 + 2;
*(_WORD *)(v4 + 64) = v42;
memmove((UINT8 *)(v4 + 80), (UINT8 *)v49->Name.Buffer, (unsigned __int16)(v42 + 2));
*(_QWORD *)(v4 + 72) = a1 + v4 + 80 - a2;
*(_WORD *)(v4 + 66) = v43;
LABEL_69:
LODWORD(Mode) = 0;
goto LABEL_70;
}
if( v9->Name.Length == (_WORD)Mode )
goto LABEL_66;
}
LABEL_67:
v10 = -1073741820;
HIDWORD(NumberOfBytes) = -1073741820;
LABEL_70:
v9 = v49;
i = v50;
v18 = v45;
goto LABEL_71;
}
v11 += 16;
v46 = v11;
if( v11 < 0x10 )
goto LABEL_18;
LABEL_66:
if( v11 < v33 )
{
RtlInitUnicodeString((PUNICODE_STRING)(v4 + 64), 0i64, v33);
goto LABEL_69;
}
goto LABEL_67;
}
v37 = ObQueryNameStringMode((VOID *)v35, v9, (unsigned int)Length, &NumberOfBytes, (INT8)Mode);
v47 = v37;
if( v37 == -1073741820 )
{
v33 = SourceString;
if( (unsigned int)NumberOfBytes <= Length || v11 + (unsigned int)NumberOfBytes >= SourceString )
goto LABEL_52;
v41 = v7;
v7 = (OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x7241624Fui64);
v54 = v7;
LODWORD(Mode) = 0;
if( !v7 )
{
v7 = v41;
v54 = v41;
v37 = -1073741670;
v47 = -1073741670;
v33 = SourceString;
goto LABEL_53;
}
ExFreePoolWithTag(v41, 0x7241624Fu);
Length = (unsigned int)NumberOfBytes;
v57 = (unsigned int)NumberOfBytes;
v9 = v7;
v49 = v7;
v61 = v7;
v37 = ObQueryNameStringMode(Object, v7, (unsigned int)NumberOfBytes, &NumberOfBytes, 0);
v47 = v37;
}
v33 = SourceString;
LABEL_52:
LODWORD(Mode) = 0;
goto LABEL_53;
}
if( a4 )
*(_DWORD *)a4 = v11;
if( v5 )
ObpDestroyTypeArray(v5);
ObpDestroyTypeArray(v13);
ExFreePoolWithTag(v7, 0x7241624Fu);
if( !v51 )
return(unsigned int)-1073741823;
return v10;
}Referenced by:
ExpGetObjectInformation