ExpTranslateNtPath
NTSTATUS __stdcall ExpTranslateNtPath(
_FILE_PATH *InputPath,
UINT64 OutputType,
_FILE_PATH *OutputPath,
UINT64 *OutputPathLength){
int v5;
CHAR *FilePath;
char v9;
char v10;
WCHAR v11;
unsigned __int64 v12;
__int64 v13;
void *v14;
NTSTATUS v15;
wchar_t *Buffer;
NTSTATUS v17;
int v18;
ULONG OutputBufferLength;
int *OutputBuffer;
NTSTATUS v21;
int *v22;
int *v23;
void *FileHandle;
UNICODE_STRING ResultName;
struct _UNICODE_STRING DestinationString;
struct _IO_STATUS_BLOCK IoStatusBlock;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
INT64 result;
__int64 v30;
__int64 v31;
int v32[6];
char v33;
int v34;
int v35;
v35 = OutputType;
*(&ObjectAttributes.Length + 1) = 0;
v5 = OutputType;
*(&ObjectAttributes.Attributes + 1) = 0;
FileHandle = 0i64;
DestinationString = 0i64;
ResultName = 0i64;
IoStatusBlock = 0i64;
memset((INT64)&result, 0i64);
FilePath = InputPath->FilePath;
v34 = 0;
v9 = 1;
v10 = 1;
RtlInitUnicodeString(&DestinationString, (PCWSTR)FilePath, v11);
v12 = (unsigned __int64)&FilePath[DestinationString.Length + 2];
v13 = -1i64;
do
++v13;
while( *(_WORD *)(v12 + 2 * v13) );
v14 = (void *)(v12 & -(__int64)((_DWORD)v13 != 0));
if( v5 != 1 )
{
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v15 = ZwOpenFile((UNICODE_STRING *)&FileHandle, (PWCHAR)0x100080);
if( v15 < 0 )
return v15;
v18 = ZwDeviceIoControlFile(FileHandle, 0i64, 0i64, 0i64, &IoStatusBlock, 0x70048u, 0i64, 0, &result, 0x90u);
if( v18 < 0 )
goto LABEL_22;
if( (_DWORD)result )
{
if( (_DWORD)result != 1 )
{
v18 = -1073741804;
LABEL_22:
ZwClose(FileHandle);
return v18;
}
}
else
{
OutputBufferLength = 2352;
for( OutputBuffer = (int *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x930ui64, 0x72766E45ui64);
;
OutputBuffer = (int *)ExAllocatePoolWithTag(NonPagedPoolNx, OutputBufferLength, 0x72766E45ui64) )
{
v22 = OutputBuffer;
if( !OutputBuffer )
{
v18 = -1073741670;
goto LABEL_22;
}
v21 = ZwDeviceIoControlFile(
FileHandle,
0i64,
0i64,
0i64,
&IoStatusBlock,
0x70050u,
0i64,
0,
OutputBuffer,
OutputBufferLength);
if( v21 >= 0 )
break;
ExFreePoolWithTag(v22, 0);
if( v21 != -1073741789 )
{
v18 = v21;
goto LABEL_22;
}
OutputBufferLength *= 2;
}
v34 = v22[2];
ExFreePoolWithTag(v22, 0);
v5 = v35;
}
ZwClose(FileHandle);
if( (_DWORD)result == 1 )
{
v23 = (int *)&v33;
}
else
{
v23 = &v34;
v9 = 0;
}
if( v5 == 4 )
return ExpCreateOutputEFI(
OutputPath,
(unsigned int *)OutputPathLength,
v23,
(__int64)v32,
(__int64)&v30,
(__int64)&v31,
v14,
v9);
else
return ExpCreateOutputSIGNATURE(
(__int64)OutputPath,
(unsigned int *)OutputPathLength,
(unsigned int *)v23,
(unsigned int *)v32,
(__int64)&v30,
(__int64)&v31,
(wchar_t *)v14,
v9);
}
v15 = ExpTranslateSymbolicLink((PWCHAR)FilePath, &ResultName);
if( v15 >= 0 )
{
Buffer = ResultName.Buffer;
}
else
{
if( v15 != -1073741788 )
return v15;
v10 = 0;
Buffer = DestinationString.Buffer;
ResultName.Length = DestinationString.Length;
ResultName.MaximumLength = DestinationString.MaximumLength;
ResultName.Buffer = DestinationString.Buffer;
}
v17 = ExpCreateOutputARC(OutputPath, OutputPathLength, &ResultName, (WCHAR *)v14);
if( v10 == 1 )
ExFreePoolWithTag(Buffer, 0);
return v17;
}Referenced by:
ExpConvertArcName
NtTranslateFilePath