NtDrawText

NTSTATUS __stdcall NtDrawText(UNICODE_STRING *String){
  int v2; 
  UINT8 *v3; 
  INT8 v4; 
  __int64 v6; 
  int v7; 
  UINT8 *v8; 
  unsigned __int64 v9; 
  UINT8 *PoolWithTag; 
  unsigned __int16 v11; 
  __int128 v12; 
  int v13; 
  v12 = 0i64;
  v2 = 0;
  v3 = 0i64;
  v4 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, v4) )
    return -1073741727;
  if( !String )
    return -1073741811;
  if( !v4 )
    goto LABEL_17;
  v6 = 0x7FFFFFFF0000i64;
  if( (unsigned __int64)String < 0x7FFFFFFF0000i64 )
    v6 = (__int64)String;
  v7 = *(_DWORD *)v6;
  v13 = *(_DWORD *)v6;
  LODWORD(v12) = *(_DWORD *)v6;
  v8 = *(UINT8 **)(v6 + 8);
  *((_QWORD *)&v12 + 1) = v8;
  if( !v8 || !HIWORD(v7) )
    goto LABEL_24;
  v9 = (unsigned __int64)&v8[HIWORD(v13)];
  if( v9 > 0x7FFFFFFF0000i64 || v9 < (unsigned __int64)v8 )
    MEMORY[0x7FFFFFFF0000] = 0;
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, HIWORD(v13), 0x67727453ui64);
  v3 = PoolWithTag;
  if( PoolWithTag )
  {
    memmove(PoolWithTag, v8, HIWORD(v13));
    *((_QWORD *)&v12 + 1) = v3;
    String = (UNICODE_STRING *)&v12;
LABEL_17:
    v2 = -1073741811;
    v11 = String->MaximumLength >> 1;
    if( v11 )
    {
      while( String->Buffer[v11 - 1] )
      {
        if( !--v11 )
          goto LABEL_22;
      }
      v2 = 0;
    }
LABEL_22:
    if( v2 >= 0 )
      v2 = BgkDrawText(String->Buffer);
    goto LABEL_24;
  }
  v2 = -1073741801;
LABEL_24:
  if( v3 )
    ExFreePoolWithTag(v3, 0);
  return v2;
}

Referenced by: