SiTranslateSymbolicLink

NTSTATUS __stdcall SiTranslateSymbolicLink(WCHAR *LinkName, WCHAR **ResultName){
  NTSTATUS result; 
  unsigned __int16 v4; 
  int v5; 
  wchar_t *Buffer; 
  _UNICODE_STRING LinkTarget; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 ReturnedLength; 
  VOID *LinkHandle; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&LinkTarget.Length = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  LinkHandle = 0i64;
  LinkTarget.Buffer = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, LinkName);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwOpenSymbolicLinkObject(&LinkHandle, 1, &ObjectAttributes);
  if( result >= 0 )
  {
    RtlInitUnicodeString(&LinkTarget, 0i64);
    v4 = 0;
    LODWORD(ReturnedLength) = 0;
    do
    {
      while( 1 )
      {
        v5 = ZwQuerySymbolicLinkObject(LinkHandle, &LinkTarget, &ReturnedLength);
        if( v5 == -1073741789 )
          break;
        ZwClose((_HANDLE)LinkHandle);
        Buffer = LinkTarget.Buffer;
        LinkHandle = 0i64;
        if( v5 < 0 )
          goto LABEL_16;
        LinkTarget.Buffer[(unsigned __int64)LinkTarget.Length >> 1] = 0;
        ObjectAttributes.ObjectName = &LinkTarget;
        LinkTarget.MaximumLength = v4;
        ObjectAttributes.Length = 48;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.Attributes = 576;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        if( ZwOpenSymbolicLinkObject(&LinkHandle, 1, &ObjectAttributes) < 0 )
        {
          Buffer = LinkTarget.Buffer;
          v5 = 0;
          *ResultName = LinkTarget.Buffer;
          goto LABEL_7;
        }
      }
      if( LinkTarget.Buffer )
        ExFreePoolWithTag(LinkTarget.Buffer, 0);
      LinkTarget.MaximumLength = ReturnedLength;
      v4 = ReturnedLength + 2;
      Buffer = (wchar_t *)ExAllocatePoolWithTag(1ui64, (unsigned int)(ReturnedLength + 2), 1263556947i64);
      LinkTarget.Buffer = Buffer;
    }
    while( Buffer );
    v5 = -1073741670;
LABEL_7:
    if( LinkHandle )
    {
      ZwClose((_HANDLE)LinkHandle);
      Buffer = LinkTarget.Buffer;
      LinkHandle = 0i64;
    }
    if( v5 < 0 )
    {
LABEL_16:
      if( Buffer )
        ExFreePoolWithTag(Buffer, 0);
    }
    return v5;
  }
  return result;
}

Referenced by: