ObpCaptureObjectName

NTSTATUS __stdcall ObpCaptureObjectName(
        INT8 ProbeMode,
        UNICODE_STRING *ObjectName,
        UNICODE_STRING *CapturedObjectName,
        UINT64 UseLookaside){
  wchar_t *Buffer; 
  unsigned __int64 v6; 
  unsigned __int16 Length; 
  unsigned int v8; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v10; 
  wchar_t *PoolWithTag; 
  __int64 v12; 
  NTSTATUS v14; 
  UNICODE_STRING Src; 
  CapturedObjectName->Buffer = 0i64;
  *(_DWORD *)&CapturedObjectName->Length = 0;
  v14 = 0;
  if( ProbeMode && *((_BYTE *)KeGetCurrentThread() + 562) )
  {
    if( (unsigned __int64)ObjectName >= 0x7FFFFFFF0000i64 )
      ObjectName = (UNICODE_STRING *)0x7FFFFFFF0000i64;
    *(_DWORD *)&Src.Length = *(_DWORD *)&ObjectName->Length;
    Buffer = ObjectName->Buffer;
    Src.Buffer = Buffer;
    if( (unsigned __int16)*(_DWORD *)&ObjectName->Length )
    {
      if( ((unsigned __int8)Buffer & 1) != 0 )
        ExRaiseDatatypeMisalignment();
      v6 = (unsigned __int64)Buffer + (unsigned __int16)*(_DWORD *)&ObjectName->Length;
      if( v6 > 0x7FFFFFFF0000i64 || v6 < (unsigned __int64)Buffer )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    Src = *ObjectName;
  }
  if( Src.Length )
  {
    Length = Src.Length;
    if( (Src.Length & 1) != 0 || Src.Length == 65534 )
    {
      return -1073741773;
    }
    else
    {
      if( (unsigned int)Src.Length + 2 < Src.Length )
        return -1073741670;
      v8 = Src.Length + 2;
      if( (_DWORD)UseLookaside && v8 <= 0xF8 )
      {
        LOWORD(v8) = 248;
        CurrentPrcb = KeGetCurrentPrcb();
        v10 = *((_QWORD *)CurrentPrcb + 266);
        ++*(_DWORD *)(v10 + 20);
        PoolWithTag = (wchar_t *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v10);
        if( !PoolWithTag )
        {
          ++*(_DWORD *)(v10 + 24);
          v12 = *((_QWORD *)CurrentPrcb + 267);
          ++*(_DWORD *)(v12 + 20);
          PoolWithTag = (wchar_t *)RtlpInterlockedPopEntrySList((PSLIST_HEADER)v12);
          if( !PoolWithTag )
          {
            ++*(_DWORD *)(v12 + 24);
            PoolWithTag = (wchar_t *)(*(__int64(__fastcall **)(_QWORD, _QWORD, _QWORD))(v12 + 48))(
                                       *(unsigned int *)(v12 + 36),
                                       *(unsigned int *)(v12 + 44),
                                       *(unsigned int *)(v12 + 40));
          }
        }
        if( PoolWithTag )
          *(_DWORD *)PoolWithTag = *((_DWORD *)CurrentPrcb + 9);
        Length = Src.Length;
      }
      else
      {
        PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v8, 0x6D4E624Fui64);
      }
      CapturedObjectName->Length = Length;
      CapturedObjectName->MaximumLength = v8;
      CapturedObjectName->Buffer = PoolWithTag;
      if( PoolWithTag )
      {
        memmove((UINT8 *)PoolWithTag, (UINT8 *)Src.Buffer, Src.Length);
        PoolWithTag[(unsigned __int64)Src.Length >> 1] = 0;
      }
      else
      {
        return -1073741670;
      }
    }
  }
  return v14;
}

Referenced by: