NtAddAtomEx

NTSTATUS __stdcall NtAddAtomEx(WCHAR *AtomName, UINT64 Length, UINT16 *Atom, UINT64 Flags){
  unsigned int v4; 
  UINT64 v6; 
  char v8; 
  WCHAR *v9; 
  __int64 v10; 
  NTSTATUS result; 
  UINT16 Atoma; 
  PVOID AtomTableHandle; 
  WCHAR *v14; 
  UINT8 dst[512]; 
  v4 = Flags;
  v6 = (unsigned int)Length;
  AtomTableHandle = 0i64;
  Atoma = 0;
  if( (Flags & 0xFFFFFFFD) != 0 )
    return -1073741811;
  PsInvokeWin32Callout(2i64, &AtomTableHandle, 0i64, 0i64);
  if( !AtomTableHandle )
    return -1073741790;
  if( (unsigned int)v6 > 0x1FE )
    return -1073741811;
  v8 = *((_BYTE *)KeGetCurrentThread() + 562);
  v9 = AtomName;
  v14 = AtomName;
  if( v8 )
  {
    if( Atom )
    {
      v10 = (__int64)Atom;
      if( (unsigned __int64)Atom >= 0x7FFFFFFF0000i64 )
        v10 = 0x7FFFFFFF0000i64;
      *(_WORD *)v10 = *(_WORD *)v10;
      v9 = v14;
    }
    if( AtomName )
    {
      if( (_DWORD)v6 )
      {
        if( ((unsigned __int8)AtomName & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)AtomName + v6 > 0x7FFFFFFF0000i64 || (WCHAR *)((char *)AtomName + v6) < AtomName )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      v9 = (WCHAR *)dst;
      v14 = (WCHAR *)dst;
      memmove(dst, (UINT8 *)AtomName, v6);
      *(_WORD *)&dst[2 * (v6 >> 1)] = 0;
    }
  }
  result = RtlAddAtomToAtomTableEx(AtomTableHandle, v9, &Atoma, v4);
  if( Atom )
  {
    if( result >= 0 )
      *Atom = Atoma;
  }
  return result;
}

Referenced by: