ObQueryTypeName

INT64 __stdcall ObQueryTypeName(VOID *Object, UNICODE_STRING *ObjectTypeName, UINT64 Length, UINT64 *ReturnLength){
  __int64 v5; 
  int v6; 
  _WORD *v8; 
  UINT64 v9; 
  UINT8 *v10; 
  v5 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)];
  v6 = *(unsigned __int16 *)(v5 + 16);
  *(_DWORD *)ReturnLength = v6 + 18;
  if( (unsigned int)Length < v6 + 18 )
    return 3221225476i64;
  v8 = (_WORD *)((char *)ObjectTypeName + (unsigned int)(v6 + 18) - 2);
  *v8 = 0;
  v9 = *(unsigned __int16 *)(v5 + 16);
  v10 = (UINT8 *)v8 - v9;
  memmove(v10, *(UINT8 **)(v5 + 24), v9);
  ObjectTypeName->Length = v6;
  ObjectTypeName->MaximumLength = v6 + 2;
  ObjectTypeName->Buffer = (wchar_t *)v10;
  return 0i64;
}

Referenced by: