MmGetFileNameForAddress

NTSTATUS __stdcall MmGetFileNameForAddress(PVOID ProcessVa, _UNICODE_STRING *FileName){
  __int64 v3; 
  void *v4; 
  _CONTROL_AREA *v6; 
  _ADAPTER_OBJECT *v7; 
  unsigned int i; 
  _OBJECT_NAME_INFORMATION *Pool; 
  _OBJECT_NAME_INFORMATION *v10; 
  int v11; 
  size_t v12; 
  UINT64 ReturnLength; 
  INT64 v14; 

  LODWORD(ReturnLength) = 0;
  LODWORD(v3) = MiObtainReferencedVadEx((UINT64)ProcessVa, 2, &v14);
  v4 = (void *)v3;
  if( !v3 )
    return -1073741503;
  if( (*(_DWORD *)(v3 + 48) & 0x100000) != 0 || (v6 = **(_CONTROL_AREA ***)(v3 + 72), (v6->u.LongFlags & 0x20) == 0) )
  {
    MiUnlockAndDereferenceVadShared((PVOID)v3);
    return -1073741751;
  }
  else
  {
    v7 = (_ADAPTER_OBJECT *)MiReferenceControlAreaFile(v6);
    MiUnlockAndDereferenceVadShared(v4);
    for( i = 1040; ; i = ReturnLength )
    {
      Pool = (_OBJECT_NAME_INFORMATION *)MiAllocatePool(256i64, i, 0x20206D4Dui64);
      v10 = Pool;
      if( !Pool )
        break;
      LODWORD(ReturnLength) = 0;
      v11 = ObQueryNameStringMode(v7, Pool, i, &ReturnLength, 0);
      if( v11 >= 0 )
      {
        v12 = *(_WORD *)v10;
        FileName->MaximumLength = v12;
        FileName->Length = v12;
        FileName->Buffer = (wchar_t *)v10;
        memmove(v10, *((const VOID **)v10 + 1), v12);
        goto LABEL_12;
      }
      ExFreePoolWithTag(v10, 0);
      if( (unsigned int)ReturnLength <= i )
        goto LABEL_12;
    }
    v11 = -1073741801;
LABEL_12:
    HalPutDmaAdapter(v7);
    return v11;
  }
}

Referenced by: