BiTranslateSymbolicLink

INT64 __stdcall BiTranslateSymbolicLink(WCHAR *LinkName, WCHAR **ResultName){
  WCHAR v2; 
  INT64 result; 
  WCHAR v5; 
  unsigned __int16 v6; 
  NTSTATUS v7; 
  wchar_t *PoolWithTag; 
  struct _UNICODE_STRING LinkTarget; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 ReturnedLength; 
  void *LinkHandle; 
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&LinkTarget.Length = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  LinkHandle = 0i64;
  LinkTarget.Buffer = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, LinkName, v2);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(result) = ZwOpenSymbolicLinkObject(&LinkHandle, 1ui64, &ObjectAttributes);
  if( (int)result >= 0 )
  {
    RtlInitUnicodeString(&LinkTarget, 0i64, v5);
    v6 = 0;
    LODWORD(ReturnedLength) = 0;
    do
    {
      while( 1 )
      {
        v7 = ZwQuerySymbolicLinkObject(LinkHandle, &LinkTarget, &ReturnedLength);
        if( v7 != -1073741789 )
          break;
        if( LinkTarget.Buffer )
          ExFreePoolWithTag(LinkTarget.Buffer, 0x4B444342u);
        LinkTarget.MaximumLength = ReturnedLength;
        v6 = ReturnedLength + 2;
        PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(ReturnedLength + 2), 0x4B444342ui64);
        LinkTarget.Buffer = PoolWithTag;
        if( !PoolWithTag )
        {
          v7 = -1073741670;
          goto LABEL_11;
        }
      }
      ZwClose(LinkHandle);
      PoolWithTag = LinkTarget.Buffer;
      LinkHandle = 0i64;
      if( v7 < 0 )
        goto LABEL_16;
      LinkTarget.Buffer[(unsigned __int64)LinkTarget.Length >> 1] = 0;
      ObjectAttributes.ObjectName = &LinkTarget;
      LinkTarget.MaximumLength = v6;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    }
    while( ZwOpenSymbolicLinkObject(&LinkHandle, 1ui64, &ObjectAttributes) >= 0 );
    PoolWithTag = LinkTarget.Buffer;
    v7 = 0;
    *ResultName = LinkTarget.Buffer;
LABEL_11:
    if( LinkHandle )
    {
      ZwClose(LinkHandle);
      PoolWithTag = LinkTarget.Buffer;
      LinkHandle = 0i64;
    }
    if( v7 < 0 )
    {
LABEL_16:
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0x4B444342u);
    }
    return(unsigned int)v7;
  }
  return result;
}

Referenced by: