NtFindAtom

NTSTATUS __stdcall NtFindAtom(WCHAR *AtomName, UINT64 Length, UINT16 *Atom){
  unsigned __int64 v4; 
  _RTL_RUN_ONCE *Win32Callouts; 
  char PreviousMode; 
  WCHAR *v8; 
  __int64 v9; 
  NTSTATUS result; 
  UINT16 Atoma; 
  VOID *Argument2; 
  WCHAR *v13; 
  int v14; 
  __int16 v15[256]; 

  v4 = (unsigned int)Length;
  Argument2 = 0i64;
  Atoma = 0;
  v14 = 0;
  Win32Callouts = MmSessionGetWin32Callouts();
  ExCallCallBack((_EX_CALLBACK *)Win32Callouts, (VOID *)2, &Argument2);
  if( !Argument2 )
    return -1073741790;
  if( (unsigned int)v4 > 0x1FE )
    return -1073741811;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v8 = AtomName;
  v13 = AtomName;
  if( PreviousMode )
  {
    if( Atom )
    {
      v9 = (__int64)Atom;
      if( (unsigned __int64)Atom >= 0x7FFFFFFF0000i64 )
        v9 = 0x7FFFFFFF0000i64;
      *(_WORD *)v9 = *(_WORD *)v9;
      v8 = v13;
    }
    if( AtomName )
    {
      if( (_DWORD)v4 )
      {
        if( ((unsigned __int8)AtomName & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)AtomName + v4 > 0x7FFFFFFF0000i64 || (WCHAR *)((char *)AtomName + v4) < AtomName )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      v8 = (WCHAR *)v15;
      v13 = (WCHAR *)v15;
      memmove(v15, AtomName, v4);
      v15[v4 >> 1] = 0;
    }
  }
  result = RtlLookupAtomInAtomTable(Argument2, v8, &Atoma);
  if( Atom )
  {
    if( result >= 0 )
      *Atom = Atoma;
  }
  return result;
}

Referenced by: