NtDisplayString

INT64 __fastcall NtDisplayString(_UNICODE_STRING *String){
  INT8 v3; 
  __int64 v4; 
  UINT8 *v5; 
  unsigned __int64 v6; 
  UINT8 *PoolWithTag; 
  WCHAR *v8; 
  wchar_t *Buffer; 
  __int64 MaximumLength; 
  UINT8 *v11; 
  UINT8 v12; 
  int P; 
  if( !String )
    return 3221225485i64;
  v3 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v3) )
    return 3221225569i64;
  if( v3 )
  {
    v4 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)String < 0x7FFFFFFF0000i64 )
      v4 = (__int64)String;
    P = *(_DWORD *)v4;
    v5 = *(UINT8 **)(v4 + 8);
    if( !v5 || !HIWORD(*(_DWORD *)v4) )
      return 0i64;
    v6 = (unsigned __int64)&v5[HIWORD(P)];
    if( v6 > 0x7FFFFFFF0000i64 || v6 < (unsigned __int64)v5 )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( !*(_WORD *)v5 )
      return 0i64;
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, HIWORD(P) + 2i64, 0x67727453ui64);
    v8 = (WCHAR *)PoolWithTag;
    if( PoolWithTag )
    {
      memmove(PoolWithTag, v5, HIWORD(P));
      v8[(unsigned __int64)HIWORD(P) >> 1] = 0;
      goto LABEL_24;
    }
    return 3221225495i64;
  }
  Buffer = String->Buffer;
  if( !Buffer )
    return 0i64;
  MaximumLength = String->MaximumLength;
  if( !(_WORD)MaximumLength || !*Buffer )
    return 0i64;
  v11 = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, MaximumLength + 2, 0x67727453ui64);
  v8 = (WCHAR *)v11;
  if( !v11 )
    return 3221225495i64;
  memmove(v11, (UINT8 *)String->Buffer, String->MaximumLength);
  v8[(unsigned __int64)String->MaximumLength >> 1] = 0;
LABEL_24:
  v12 = BgkDisplayStringEx(v8);
  ExFreePoolWithTag(v8, 0);
  if( !v12 )
    return 3221225473i64;
  return 0i64;
}

Referenced by: