ObQueryNameStringMode

INT64 __stdcall ObQueryNameStringMode(
        VOID *Object,
        OBJECT_NAME_INFORMATION *ObjectNameInfo,
        UINT64 Length,
        UINT64 *ReturnLength,
        INT8 Mode){
  unsigned int v6; 
  INT64 *v9; 
  unsigned __int64 v10; 
  char *v11; 
  __int64(__fastcall *v12)(VOID *, unsigned __int64, OBJECT_NAME_INFORMATION *, _QWORD, UINT64 *, INT8); 
  _EJOB *CurrentSilo; 
  _DWORD *v15; 
  void **v16; 
  struct _DMA_ADAPTER *v17; 
  unsigned int v18; 
  _DWORD *v19; 
  char *v20; 
  INT64 *v21; 
  INT64 *v22; 
  OBJECT_NAME_INFORMATION *p_MaximumLength; 
  UINT64 v24; 
  UINT8 *v25; 
  UINT8 *v26; 
  UINT8 *v27; 
  struct _DMA_ADAPTER *v28; 
  UINT64 v29; 
  UINT8 *v30; 
  unsigned int v31; 
  INT64 *v32; 
  OBJECT_NAME_INFORMATION *v33; 
  char v34; 
  char v35; 
  int v36; 
  unsigned int v37; 
  struct _DMA_ADAPTER *DmaAdapter; 
  UINT8 *v39; 
  unsigned int v40; 
  unsigned int v41; 
  UINT8 *v42; 
  INT64 *Lock; 
  UINT8 **Locka; 
  _DWORD *v45; 
  _DWORD *v46; 
  UINT8 *v47; 
  _DWORD *v48; 
  void **v49; 
  _DWORD *v50; 
  INT64 *v51; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v53; 
  _ETHREAD *v54; 
  _ETHREAD *v55; 
  v6 = Length;
  v34 = 1;
  v35 = 0;
  v41 = 0;
  DmaAdapter = 0i64;
  v36 = -1073741823;
  v9 = (INT64 *)((char *)Object - 48);
  v10 = (unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8);
  if( (*((char *)Object - 22) & 2) != 0 )
    v11 = (char *)v9 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*((char *)Object - 22) & 3));
  else
    v11 = 0i64;
  v49 = (void **)v11;
  v12 = *(__int64(__fastcall **)(VOID *, unsigned __int64, OBJECT_NAME_INFORMATION *, _QWORD, UINT64 *, INT8))(ObTypeIndexTable[v10] + 160);
  if( v12 )
  {
    if( v11 && *((_WORD *)v11 + 4) )
      LOBYTE(v10) = 1;
    else
      v10 = 0i64;
    v36 = v12(Object, v10, ObjectNameInfo, (unsigned int)Length, ReturnLength, Mode);
LABEL_7:
    if( v36 >= 0 )
LABEL_8:
      *(_DWORD *)(&ObjectNameInfo->Name.MaximumLength + 1) = 0;
    return(unsigned int)v36;
  }
  CurrentSilo = PsGetCurrentSilo();
  v15 = OBP_GET_SILO_ROOT_DIRECTORY_FROM_SILO((__int64)CurrentSilo);
  v48 = v15;
  while( v11 )
  {
    if( Object != v15 && Object != ObpRootDirectoryObject )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockSharedEx((UINT64)(v9 + 2), 0i64);
      v16 = v49;
      v17 = (struct _DMA_ADAPTER *)*v49;
      v45 = *v49;
      if( *v49 )
      {
        ObfReferenceObject(v17);
        DmaAdapter = v17;
        v16 = v49;
      }
      v37 = *((unsigned __int16 *)v16 + 4) + 2;
      if( _InterlockedCompareExchange64(v9 + 2, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v9 + 2);
      KeAbPostRelease(v9 + 2);
      KeLeaveCriticalRegion();
      v18 = v37;
      v19 = v45;
      while( v19 != v48 && v19 != ObpRootDirectoryObject && v19 && (v19[84] & 0x20) == 0 )
      {
        v50 = v19 - 12;
        v53 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v53 + 242);
        Lock = (INT64 *)(v19 - 8);
        ExAcquirePushLockSharedEx((UINT64)Lock, 0i64);
        if( (*((_BYTE *)v50 + 26) & 2) == 0
          || (v20 = (char *)v50 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*((_BYTE *)v50 + 26) & 3))) == 0i64
          || !*(_QWORD *)v20 )
        {
          v22 = Lock;
          if( _InterlockedCompareExchange64(Lock, 0i64, 17i64) != 17 )
          {
            ExfReleasePushLockShared(Lock);
            v22 = Lock;
          }
          KeAbPostRelease(v22);
          KeLeaveCriticalRegion();
          v18 = v37 + 8;
          break;
        }
        v37 += 2 + *((unsigned __int16 *)v20 + 4);
        v46 = *(_DWORD **)v20;
        ObfReferenceObject(*(PVOID *)v20);
        v21 = Lock;
        if( _InterlockedCompareExchange64(Lock, 0i64, 17i64) != 17 )
        {
          ExfReleasePushLockShared(Lock);
          v21 = Lock;
        }
        KeAbPostRelease(v21);
        KeLeaveCriticalRegion();
        HalPutDmaAdapter(DmaAdapter);
        v19 = v46;
        DmaAdapter = (struct _DMA_ADAPTER *)v46;
        v18 = v37;
        if( v37 > 0xFFFF )
          goto LABEL_37;
      }
      if( v18 <= 0xFFFF )
        goto LABEL_31;
LABEL_37:
      v36 = -1073741562;
      goto LABEL_33;
    }
    v18 = 2;
LABEL_31:
    v41 = v18 + 18;
    *(_DWORD *)ReturnLength = v18 + 18;
    if( v6 < v18 + 18 )
    {
      v36 = -1073741820;
LABEL_33:
      v34 = 0;
    }
    if( DmaAdapter )
    {
      HalPutDmaAdapter(DmaAdapter);
      DmaAdapter = 0i64;
    }
    if( !v34 )
      goto LABEL_7;
    if( (*((_BYTE *)v9 + 26) & 2) != 0 )
      v11 = (char *)v9 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*((_BYTE *)v9 + 26) & 3));
    else
      v11 = 0i64;
    v49 = (void **)v11;
    if( !v11 )
      goto LABEL_91;
    p_MaximumLength = (OBJECT_NAME_INFORMATION *)((char *)ObjectNameInfo + v41 - 2);
    p_MaximumLength->Name.Length = 0;
    if( Object == v48 || Object == ObpRootDirectoryObject )
      goto LABEL_66;
    v24 = *((unsigned __int16 *)v11 + 4);
    v25 = (UINT8 *)p_MaximumLength - v24;
    v42 = v25;
    if( v25 > (UINT8 *)&ObjectNameInfo[1] )
    {
      memmove(v25, *((UINT8 **)v11 + 2), v24);
      v54 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v54 + 242);
      ExAcquirePushLockSharedEx((UINT64)(v9 + 2), 0i64);
      v26 = *(UINT8 **)v11;
      v47 = v26;
      if( v26 )
      {
        ObfReferenceObject(v26);
        DmaAdapter = (struct _DMA_ADAPTER *)v26;
      }
      if( _InterlockedCompareExchange64(v9 + 2, 0i64, 17i64) != 17 )
        ExfReleasePushLockShared(v9 + 2);
      KeAbPostRelease(v9 + 2);
      KeLeaveCriticalRegion();
      while( 1 )
      {
        if( v47 == (UINT8 *)v48 || v47 == ObpRootDirectoryObject || !v47 || (*((_DWORD *)v47 + 84) & 0x20) != 0 )
        {
          p_MaximumLength = (OBJECT_NAME_INFORMATION *)v42;
          goto LABEL_66;
        }
        v39 = v42 - 2;
        *((_WORD *)v42 - 1) = 92;
        v27 = v47 - 48;
        Locka = (*(v47 - 22) & 2) != 0 ? (UINT8 **)&v27[-*((unsigned __int8 *)ObpInfoMaskToOffset + (*(v47 - 22) & 3))] : 0i64;
        v55 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v55 + 242);
        v51 = (INT64 *)(v27 + 16);
        ExAcquirePushLockSharedEx((UINT64)(v27 + 16), 0i64);
        if( !Locka || !*Locka )
          break;
        HalPutDmaAdapter(DmaAdapter);
        v28 = (struct _DMA_ADAPTER *)*Locka;
        v47 = *Locka;
        ObfReferenceObject(*Locka);
        DmaAdapter = v28;
        v29 = *((unsigned __int16 *)Locka + 4);
        v42 = &v39[-v29];
        if( &v39[-v29] <= (UINT8 *)&ObjectNameInfo[1] )
        {
          v35 = 1;
          if( _InterlockedCompareExchange64(v51, 0i64, 17i64) != 17 )
            ExfReleasePushLockShared(v51);
          KeAbPostRelease(v51);
          KeLeaveCriticalRegion();
          goto LABEL_79;
        }
        memmove(&v39[-v29], Locka[2], v29);
        if( _InterlockedCompareExchange64(v51, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared(v51);
        KeAbPostRelease(v51);
        KeLeaveCriticalRegion();
      }
      v32 = v51;
      if( _InterlockedCompareExchange64(v51, 0i64, 17i64) != 17 )
      {
        ExfReleasePushLockShared(v51);
        v32 = v51;
      }
      KeAbPostRelease(v32);
      KeLeaveCriticalRegion();
      p_MaximumLength = (OBJECT_NAME_INFORMATION *)(v42 - 8);
      v33 = (OBJECT_NAME_INFORMATION *)(v42 - 8);
      if( v42 - 8 < (UINT8 *)&ObjectNameInfo[1] )
      {
        p_MaximumLength = ObjectNameInfo + 1;
        v33 = ObjectNameInfo + 1;
      }
      *(_DWORD *)&p_MaximumLength->Name.Length = *(_DWORD *)L"...";
      *(&p_MaximumLength->Name.MaximumLength + 1) = asc_1407D3680[2];
      if( v33 == &ObjectNameInfo[1] )
        p_MaximumLength = (OBJECT_NAME_INFORMATION *)&v33->Name.MaximumLength;
LABEL_66:
      v30 = (UINT8 *)&p_MaximumLength[-1].Name.Buffer + 6;
      *(_WORD *)v30 = 92;
      v31 = (unsigned __int16)((_WORD)ObjectNameInfo + v41 - ((_WORD)p_MaximumLength - 2));
      v40 = v31;
      ObjectNameInfo->Name.MaximumLength = v31;
      ObjectNameInfo->Name.Length = v31 - 2;
      ObjectNameInfo->Name.Buffer = &ObjectNameInfo[1].Name.Length;
      if( &ObjectNameInfo[1] != (OBJECT_NAME_INFORMATION *)v30 )
      {
        memmove((UINT8 *)&ObjectNameInfo[1], v30, v31);
        *(_DWORD *)ReturnLength = v40 + 16;
      }
      goto LABEL_79;
    }
    v35 = 1;
LABEL_79:
    if( DmaAdapter )
      HalPutDmaAdapter(DmaAdapter);
    if( !v35 )
      goto LABEL_82;
    if( (*((_BYTE *)v9 + 26) & 2) != 0 )
      v11 = (char *)v9 - *((unsigned __int8 *)ObpInfoMaskToOffset + (*((_BYTE *)v9 + 26) & 3));
    else
      v11 = 0i64;
    v49 = (void **)v11;
    v35 = 0;
LABEL_91:
    v15 = v48;
  }
  *(_DWORD *)ReturnLength = 16;
  if( v6 >= 0x10 )
  {
    *(_DWORD *)&ObjectNameInfo->Name.Length = 0;
    ObjectNameInfo->Name.Buffer = 0i64;
LABEL_82:
    v36 = 0;
    goto LABEL_8;
  }
  return(unsigned int)-1073741820;
}

Referenced by: