SepQueryTypeString
INT64 __stdcall SepQueryTypeString(PVOID Object, UNICODE_STRING **TypeName){
INT64 result;
UNICODE_STRING *PoolWithTag;
UNICODE_STRING v6;
SIZE_T NumberOfBytes;
*TypeName = 0i64;
LODWORD(NumberOfBytes) = 0;
v6 = 0i64;
result = ObQueryTypeName(Object, &v6, 0i64, &NumberOfBytes);
if( (_DWORD)result == -1073741820 )
{
PoolWithTag = (UNICODE_STRING *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x6E546553ui64);
*TypeName = PoolWithTag;
if( PoolWithTag )
{
result = ObQueryTypeName(Object, PoolWithTag, (unsigned int)NumberOfBytes, &NumberOfBytes);
if( (int)result < 0 )
{
ExFreePoolWithTag(*TypeName, 0);
*TypeName = 0i64;
return 0i64;
}
}
else
{
return 3221225626i64;
}
}
return result;
}Referenced by:
SeOpenObjectAuditAlarmWithTransaction
SeOpenObjectForDeleteAuditAlarmWithTransaction
SeSecurityDescriptorChangedAuditAlarm
SeTokenDefaultDaclChangedAuditAlarm
SepAdtObjectReferenceAuditAlarm