ExpFindArcName

INT64 __fastcall ExpFindArcName(_UNICODE_STRING *pDeviceNameString, WCHAR **pArcName){
  UINT8 v2; 
  WCHAR *PoolWithTag; 
  WCHAR *v4; 
  WCHAR v6; 
  NTSTATUS v7; 
  WCHAR v8; 
  UNICODE_STRING *v9; 
  UINT64 v10; 
  UINT8 RestartScan; 
  NTSTATUS v12; 
  UINT64 v13; 
  WCHAR *v14; 
  WCHAR *v15; 
  unsigned int v16; 
  NTSTATUS v17; 
  void *DirectoryHandle; 
  struct _UNICODE_STRING DestinationString; 
  UNICODE_STRING String2; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 BufferLength; 
  UINT64 Context; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DirectoryHandle = 0i64;
  LODWORD(BufferLength) = 0;
  DestinationString = 0i64;
  LODWORD(Context) = 0;
  v2 = 0;
  String2 = 0i64;
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x12ui64, 0x72766E45ui64);
  v4 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  wcscpy_s(PoolWithTag, 9ui64, (PWCHAR)L"\\ArcName");
  RtlInitUnicodeString(&DestinationString, v4, v6);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v7 = ZwOpenDirectoryObject(&DirectoryHandle, 1ui64, &ObjectAttributes);
  ExFreePoolWithTag(v4, 0);
  if( v7 < 0 )
    return(unsigned int)v7;
  v9 = 0i64;
  LODWORD(v10) = 0;
  RestartScan = 1;
  RtlInitUnicodeString(&String2, L"SymbolicLink", v8);
  while( 1 )
  {
    v12 = ZwQueryDirectoryObject(DirectoryHandle, v9, (unsigned int)v10, 1u, RestartScan, &Context, &BufferLength);
    if( v12 == -1073741789 )
    {
      v10 = (unsigned int)BufferLength;
      if( v9 )
        ExFreePoolWithTag(v9, 0);
      v9 = (UNICODE_STRING *)ExAllocatePoolWithTag(NonPagedPoolNx, v10, 0x72766E45ui64);
      if( !v9 )
      {
        v17 = -1073741670;
        goto LABEL_28;
      }
      v12 = ZwQueryDirectoryObject(DirectoryHandle, v9, (unsigned int)v10, 1u, RestartScan, &Context, &BufferLength);
    }
    RestartScan = 0;
    if( v12 < 0 )
      break;
    if( RtlEqualUnicodeString(v9 + 1, &String2, 0) )
    {
      v13 = (unsigned int)v9->Length + 18 + 2i64;
      LODWORD(BufferLength) = v9->Length + 18;
      v14 = (WCHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, v13, 0x72766E45ui64);
      v15 = v14;
      if( !v14 )
      {
        v17 = -1073741670;
        goto LABEL_26;
      }
      v16 = v9->Length >> 1;
      wcscpy_s(v14, ((unsigned __int64)(unsigned int)BufferLength >> 1) + 1, (PWCHAR)L"\\ArcName\\");
      wcsncat_s(v15, ((unsigned __int64)(unsigned int)BufferLength >> 1) + 1, v9->Buffer, v16);
      v15[(unsigned __int64)(unsigned int)BufferLength >> 1] = 0;
      v17 = ExpTranslateSymbolicLink(v15, &DestinationString);
      if( v17 < 0 )
      {
        ExFreePoolWithTag(v15, 0);
        goto LABEL_23;
      }
      v2 = RtlEqualUnicodeString(&DestinationString, pDeviceNameString, 1u);
      ExFreePoolWithTag(DestinationString.Buffer, 0);
      if( v2 == 1 )
      {
        wcsncpy_s(v15, ((unsigned __int64)(unsigned int)BufferLength >> 1) + 1, v9->Buffer, v16);
        v15[v16] = 0;
        *pArcName = v15;
        goto LABEL_23;
      }
      ExFreePoolWithTag(v15, 0);
    }
  }
  v17 = 0;
  if( v12 != -2147483622 )
    v17 = v12;
LABEL_23:
  if( v17 >= 0 && !v2 )
    v17 = -1073741766;
LABEL_26:
  if( v9 )
    ExFreePoolWithTag(v9, 0);
LABEL_28:
  ZwClose(DirectoryHandle);
  return(unsigned int)v17;
}

Referenced by: