NtQuerySymbolicLinkObject

NTSTATUS __stdcall NtQuerySymbolicLinkObject(VOID *LinkHandle, _UNICODE_STRING *LinkTarget, UINT64 *ReturnedLength){
  char PreviousMode; 
  __int64 v7; 
  __int64 p_MaximumLength; 
  __int64 v9; 
  _ETHREAD *CurrentThread; 
  char *v11; 
  int v12; 
  size_t v13; 
  PVOID Object; 
  ULONG_PTR PushLock[2]; 
  VOID *Src[2]; 
  VOID *v18[2]; 
  int v19; 

  *(_OWORD *)v18 = 0i64;
  *(_OWORD *)Src = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    if( ((unsigned __int8)LinkTarget & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v7 = (__int64)LinkTarget;
    if( (unsigned __int64)LinkTarget >= 0x7FFFFFFF0000i64 )
      v7 = 0x7FFFFFFF0000i64;
    *(_WORD *)v7 = *(_WORD *)v7;
    p_MaximumLength = (__int64)&LinkTarget->MaximumLength;
    if( (unsigned __int64)&LinkTarget->MaximumLength >= 0x7FFFFFFF0000i64 )
      p_MaximumLength = 0x7FFFFFFF0000i64;
    *(_WORD *)p_MaximumLength = *(_WORD *)p_MaximumLength;
    *(_UNICODE_STRING *)v18 = *LinkTarget;
    ProbeForWrite(_mm_srli_si128(*(__m128i *)v18, 8).m128i_u64[0], WORD1(v18[0]), 1i64);
    if( ReturnedLength )
    {
      v9 = (__int64)ReturnedLength;
      if( (unsigned __int64)ReturnedLength >= 0x7FFFFFFF0000i64 )
        v9 = 0x7FFFFFFF0000i64;
      *(_DWORD *)v9 = *(_DWORD *)v9;
    }
  }
  else
  {
    *(_UNICODE_STRING *)v18 = *LinkTarget;
  }
  Object = 0i64;
  v19 = ObReferenceObjectByHandle(LinkHandle, 1ui64, ObjectType, PreviousMode, &Object, 0i64);
  if( v19 >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v11 = (char *)Object;
    *(_QWORD *)PushLock = (char *)Object - 32;
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Object - 4, 0i64);
    if( (*((_DWORD *)v11 + 7) & 0x10) != 0 )
      RtlInitUnicodeString((PUNICODE_STRING)Src, (PCWSTR)&dword_1407CF120);
    else
      *(_OWORD *)Src = *(_OWORD *)(v11 + 8);
    v12 = (int)Src[0];
    if( ReturnedLength )
    {
      if( WORD1(Src[0]) <= WORD1(v18[0]) )
      {
        v13 = WORD1(Src[0]);
LABEL_18:
        memmove(v18[1], Src[1], v13);
        LinkTarget->Length = v12;
        if( ReturnedLength )
          *(_DWORD *)ReturnedLength = HIWORD(v12);
LABEL_20:
        ExReleasePushLockEx(PushLock[0], 0);
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        return v19;
      }
    }
    else if( LOWORD(Src[0]) <= WORD1(v18[0]) )
    {
      v13 = LOWORD(Src[0]);
      goto LABEL_18;
    }
    v19 = -1073741789;
    if( ReturnedLength )
      *(_DWORD *)ReturnedLength = WORD1(Src[0]);
    goto LABEL_20;
  }
  return v19;
}

Referenced by: