SmKmEtwAppendObjectName

INT64 __fastcall SmKmEtwAppendObjectName(INT64 a1, UINT64 DeviceAttachmentBaseRefWithTag){
  unsigned int v2; 
  unsigned int v4; 
  __int64 v6; 
  UINT8 *v7; 
  _OBJECT_NAME_INFORMATION *v8; 
  unsigned int v9; 
  void *v10; 
  UINT8 v11; 
  int v12; 
  UINT8 *Buffer; 
  unsigned __int16 v14; 
  unsigned __int16 *v15; 
  unsigned int v16; 
  unsigned __int16 **v17; 
  __int64 v18; 
  INT64 result; 
  INT64 *v20; 
  UINT64 ReturnLength; 
  __int128 Src[2]; 
  v2 = *(_DWORD *)(a1 + 24);
  v4 = *(_DWORD *)(a1 + 28) - v2;
  LODWORD(ReturnLength) = 0;
  v6 = *(_QWORD *)(a1 + 8) + v2;
  Src[0] = *(_OWORD *)L"\\Device\\Unknown";
  Src[1] = *(_OWORD *)L"Unknown";
  v7 = (UINT8 *)(v6 + 2);
  v8 = (_OBJECT_NAME_INFORMATION *)((v6 + 9) & 0xFFFFFFFFFFFFFFF8ui64);
  v9 = v6 + v4 - (_DWORD)v8;
  *(_QWORD *)&v8->Name.Length = 0i64;
  v8->Name.Buffer = 0i64;
  if( (DeviceAttachmentBaseRefWithTag & 1) != 0 )
  {
    DeviceAttachmentBaseRefWithTag = (UINT64)IoGetDeviceAttachmentBaseRefWithTag(
                                               (DEVICE_OBJECT *)(DeviceAttachmentBaseRefWithTag & 0xFFFFFFFFFFFFFFFEui64),
                                               0x746C6644ui64);
    v10 = (void *)DeviceAttachmentBaseRefWithTag;
  }
  else
  {
    v10 = 0i64;
  }
  if( DeviceAttachmentBaseRefWithTag )
  {
    v11 = IoSetThreadHardErrorMode(0);
    v12 = ObQueryNameString((VOID *)DeviceAttachmentBaseRefWithTag, v8, v9, &ReturnLength);
    if( v10 )
      ObfDereferenceObjectWithTag(v10, 0x746C6644ui64);
    IoSetThreadHardErrorMode(v11);
  }
  else
  {
    v12 = -1073741809;
  }
  if( v12 >= 0 && v8->Name.Length )
  {
    Buffer = (UINT8 *)v8->Name.Buffer;
    v14 = v8->Name.Length >> 1;
  }
  else
  {
    Buffer = (UINT8 *)Src;
    v14 = 15;
  }
  memmove(v7, Buffer, 2i64 * v14);
  v15 = (unsigned __int16 *)(*(_QWORD *)(a1 + 8) + *(unsigned int *)(a1 + 24));
  v16 = 2 * v14;
  *v15 = v14;
  v17 = (unsigned __int16 **)(*(_QWORD *)a1 + 16i64 * *(unsigned int *)(a1 + 16));
  *v17 = v15;
  v17[1] = (unsigned __int16 *)2;
  v18 = (unsigned int)++*(_DWORD *)(a1 + 16);
  *(_DWORD *)(a1 + 24) += 2;
  result = *(_QWORD *)(a1 + 8) + *(unsigned int *)(a1 + 24);
  v20 = (INT64 *)(*(_QWORD *)a1 + 16 * v18);
  *v20 = result;
  v20[1] = v16;
  ++*(_DWORD *)(a1 + 16);
  *(_DWORD *)(a1 + 24) += v16;
  return result;
}

Referenced by: