PiUEventHandleVetoEvent

NTSTATUS __stdcall PiUEventHandleVetoEvent(
        FILE_OBJECT *FileObject,
        PVOID Buffer,
        UINT64 InputBufferLength,
        IO_STATUS_BLOCK *IoStatus){
  char *FsContext2; 
  NTSTATUS AllocatedFullProcessImageName; 
  _EPROCESS *v6; 
  UNICODE_STRING *v7; 
  char v8; 
  __int64 v9; 
  FAST_MUTEX *v10; 
  INT64 *v11; 
  INT64 v13; 
  _DWORD *v14; 
  __int64 v15; 
  NTSTATUS v16; 
  UNICODE_STRING *v17; 
  const char *ProcessImageFileName; 
  INT8 v19; 
  PVOID P; 
  struct _STRING DestinationString; 
  UNICODE_STRING v22; 
  _EPROCESS *Process; 
  __int64 v24; 
  FsContext2 = (char *)FileObject->FsContext2;
  Process = 0i64;
  P = 0i64;
  AllocatedFullProcessImageName = 0;
  v6 = 0i64;
  v7 = 0i64;
  v8 = 0;
  v22 = 0i64;
  if( FsContext2 && Buffer && (_DWORD)InputBufferLength == 8 )
  {
    v9 = *(_QWORD *)Buffer;
    v10 = (FAST_MUTEX *)*((_QWORD *)FsContext2 + 2);
    *(_QWORD *)&DestinationString.Length = *(_QWORD *)Buffer;
    KeAcquireGuardedMutex(v10);
    v11 = (INT64 *)*((_QWORD *)FsContext2 + 12);
    if( v11 == (INT64 *)(FsContext2 + 96) )
    {
      AllocatedFullProcessImageName = -1073741811;
      KeReleaseGuardedMutex(*((_FAST_MUTEX **)FsContext2 + 2));
      goto LABEL_11;
    }
    if( *(_BYTE *)(v11[3] + 69) )
    {
      KeAcquireGuardedMutex(&PiUEventUsermodeEventQueueLock);
      v13 = v11[3];
      v14 = *(_DWORD **)(v13 + 32);
      if( v14 )
      {
        v15 = *(_QWORD *)(v13 + 40);
        if( v15 )
        {
          if( !*v14 )
          {
            if( (_BYTE)v9 )
            {
              *v14 = *(_DWORD *)(&DestinationString.MaximumLength + 1);
              v16 = PsLookupProcessByProcessId(*((HANDLE *)FsContext2 + 6), (PEPROCESS *)&Process);
              v6 = Process;
              if( v16 < 0
                || (AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageName((__int64)Process, &P),
                    AllocatedFullProcessImageName < 0) )
              {
                v7 = &v22;
                RtlInitUnicodeString(&v22, &word_1407CF120, (WCHAR)v17);
                AllocatedFullProcessImageName = 0;
              }
              else
              {
                v7 = (UNICODE_STRING *)P;
                if( !*(_WORD *)P )
                {
                  v8 = 1;
                  DestinationString = 0i64;
                  ExFreePoolWithTag(P, 0);
                  v7 = &v22;
                  ProcessImageFileName = (const char *)PsGetProcessImageFileName((__int64)v6);
                  RtlInitAnsiString(&DestinationString, ProcessImageFileName, v19);
                  RtlAnsiStringToUnicodeString(&v22, &DestinationString, 1u);
                }
              }
              if( v7->Length > 0x400u )
              {
                AllocatedFullProcessImageName = RtlStringCchCopyNW(
                                                  *(WCHAR **)(*(_QWORD *)(v11[3] + 40) + 8i64),
                                                  0x200ui64,
                                                  v7->Buffer,
                                                  0x1FFui64);
                *(_WORD *)(*(_QWORD *)(*(_QWORD *)(v11[3] + 40) + 8i64) + 1022i64) = 0;
                **(_WORD **)(v11[3] + 40) = 1024;
              }
              else
              {
                RtlCopyUnicodeString(*(UNICODE_STRING **)(v11[3] + 40), v7, v17);
              }
              KeSetEvent(*(PRKEVENT *)(v11[3] + 24), 0);
            }
            else
            {
              **(_WORD **)(v15 + 8) = 0;
              **(_WORD **)(v13 + 40) = 0;
              **(_DWORD **)(v13 + 32) = 0;
            }
          }
        }
      }
      KeReleaseGuardedMutex(&PiUEventUsermodeEventQueueLock);
    }
    PiUEventDequeuePendingEventWorker((INT64)FsContext2, v11, 1);
    KeReleaseGuardedMutex(*((_FAST_MUTEX **)FsContext2 + 2));
  }
  else
  {
    AllocatedFullProcessImageName = -1073741811;
  }
  if( v8 )
  {
    RtlFreeAnsiString(v7);
  }
  else if( v7 && v7 != &v22 )
  {
    ExFreePoolWithTag(v7, 0);
  }
  if( v6 )
    ObfDereferenceObjectWithTag(v6, 0x746C6644ui64);
LABEL_11:
  *(_QWORD *)(v24 + 8) = 0i64;
  return AllocatedFullProcessImageName;
}

Referenced by: