SepQueryNameString

INT64 __fastcall SepQueryNameString(VOID *Object, _OBJECT_NAME_INFORMATION **ObjectNameInfo){
  int v4; 
  int v5; 
  OBJECT_NAME_INFORMATION *PoolWithTag; 
  SIZE_T NumberOfBytes; 
  *ObjectNameInfo = 0i64;
  LODWORD(NumberOfBytes) = 0;
  v4 = ObQueryNameStringMode(Object, 0i64, 0i64, &NumberOfBytes, 0);
  v5 = v4;
  if( v4 == -1073741820 || v4 == -1073741789 )
  {
    PoolWithTag = (OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(
                                               PagedPool,
                                               (unsigned int)NumberOfBytes,
                                               0x6E4F6553ui64);
    *ObjectNameInfo = PoolWithTag;
    if( PoolWithTag )
    {
      v5 = ObQueryNameStringMode(Object, PoolWithTag, (unsigned int)NumberOfBytes, &NumberOfBytes, 0);
      if( v5 < 0 || !(*ObjectNameInfo)->Name.Length )
      {
        ExFreePoolWithTag(*ObjectNameInfo, 0);
        *ObjectNameInfo = 0i64;
        if( v5 >= 0
          && (POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Object - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Object - 48) >> 8)] == PsProcessType )
        {
          PsGetAllocatedFullProcessImageNameEx((__int64)Object, ObjectNameInfo);
        }
        return 0;
      }
    }
    else
    {
      return(unsigned int)-1073741670;
    }
  }
  return(unsigned int)v5;
}

Referenced by: