ExpFindArcName

NTSTATUS __stdcall ExpFindArcName(_UNICODE_STRING *pDeviceNameString, WCHAR **pArcName){
  unsigned __int8 v2; 
  VOID **PoolWithTag; 
  wchar_t *v4; 
  int v6; 
  _UNICODE_STRING *v7; 
  UINT64 v8; 
  UINT8 RestartScan; 
  NTSTATUS v10; 
  UINT64 v11; 
  VOID **v12; 
  WCHAR *v13; 
  unsigned int v14; 
  int v15; 
  VOID *DirectoryHandle; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING String2; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 NumberOfBytes; 
  UINT64 Context; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  DirectoryHandle = 0i64;
  LODWORD(NumberOfBytes) = 0;
  DestinationString = 0i64;
  LODWORD(Context) = 0;
  v2 = 0;
  String2 = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x12ui64, 1920364101i64);
  v4 = (wchar_t *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  wcscpy_s((PWCHAR)PoolWithTag, 9ui64, (PWCHAR)L"\\ArcName");
  RtlInitUnicodeString(&DestinationString, v4);
  ObjectAttributes.Length = 48;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v6 = ZwOpenDirectoryObject(&DirectoryHandle, 1, &ObjectAttributes);
  ExFreePoolWithTag(v4, 0);
  if( v6 < 0 )
    return v6;
  v7 = 0i64;
  LODWORD(v8) = 0;
  RestartScan = 1;
  RtlInitUnicodeString(&String2, L"SymbolicLink");
  while( 1 )
  {
    v10 = ZwQueryDirectoryObject(DirectoryHandle, v7, (unsigned int)v8, 1u, RestartScan, &Context, &NumberOfBytes);
    if( v10 == -1073741789 )
    {
      v8 = (unsigned int)NumberOfBytes;
      if( v7 )
        ExFreePoolWithTag(v7, 0);
      v7 = (_UNICODE_STRING *)ExAllocatePoolWithTag(0x200ui64, v8, 1920364101i64);
      if( !v7 )
      {
        v15 = -1073741670;
        goto LABEL_28;
      }
      v10 = ZwQueryDirectoryObject(DirectoryHandle, v7, (unsigned int)v8, 1u, RestartScan, &Context, &NumberOfBytes);
    }
    RestartScan = 0;
    if( v10 < 0 )
      break;
    if( (unsigned __int8)RtlEqualUnicodeString(v7 + 1, &String2, 0) )
    {
      v11 = (unsigned int)v7->Length + 18 + 2i64;
      LODWORD(NumberOfBytes) = v7->Length + 18;
      v12 = ExAllocatePoolWithTag(0x200ui64, v11, 1920364101i64);
      v13 = (WCHAR *)v12;
      if( !v12 )
      {
        v15 = -1073741670;
        goto LABEL_26;
      }
      v14 = v7->Length >> 1;
      wcscpy_s((PWCHAR)v12, ((unsigned __int64)(unsigned int)NumberOfBytes >> 1) + 1, (PWCHAR)L"\\ArcName\\");
      wcsncat_s(v13, ((unsigned __int64)(unsigned int)NumberOfBytes >> 1) + 1, v7->Buffer, v14);
      v13[(unsigned __int64)(unsigned int)NumberOfBytes >> 1] = 0;
      v15 = ExpTranslateSymbolicLink(v13, &DestinationString);
      if( v15 < 0 )
      {
        ExFreePoolWithTag(v13, 0);
        goto LABEL_23;
      }
      v2 = (unsigned __int8)RtlEqualUnicodeString(&DestinationString, pDeviceNameString, 1u);
      ExFreePoolWithTag(DestinationString.Buffer, 0);
      if( v2 == 1 )
      {
        wcsncpy_s(v13, ((unsigned __int64)(unsigned int)NumberOfBytes >> 1) + 1, v7->Buffer, v14);
        v13[v14] = 0;
        *pArcName = v13;
        goto LABEL_23;
      }
      ExFreePoolWithTag(v13, 0);
    }
  }
  v15 = 0;
  if( v10 != -2147483622 )
    v15 = v10;
LABEL_23:
  if( v15 >= 0 && !v2 )
    v15 = -1073741766;
LABEL_26:
  if( v7 )
    ExFreePoolWithTag(v7, 0);
LABEL_28:
  ZwClose((_HANDLE)DirectoryHandle);
  return v15;
}

Referenced by: