IoIsValidNameGraftingBuffer

INT8 __fastcall IoIsValidNameGraftingBuffer(INT64 a1, UINT16 *a2){
  __int64 v2; 
  unsigned int v4; 
  UINT16 v5; 
  UINT16 v6; 
  VOID **PoolWithTag; 
  VOID **v8; 
  NTSTATUS v10; 
  UINT16 v11; 
  UINT16 v12; 
  UINT16 v13; 
  VOID *LinkHandle; 
  _UNICODE_STRING LinkTarget; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR SourceString[8]; 

  v2 = *(_QWORD *)(a1 + 184);
  DestinationString = 0i64;
  v4 = *(_DWORD *)(v2 + 8);
  if( v4 && v4 < a2[5] + (unsigned int)a2[7] + 20 )
    return 0;
  v5 = a2[5];
  if( v5 > 6u && a2[8] == 92 && a2[9] == 92 )
  {
    v6 = a2[10];
    if( v6 != 46 && v6 != 63 )
      return 0;
  }
  if( v5 > 0x10u
    && a2[8] == 92
    && a2[9] == 63
    && a2[10] == 63
    && a2[11] == 92
    && a2[12] == 85
    && a2[13] == 78
    && a2[14] == 67
    && a2[15] == 92 )
  {
    return 0;
  }
  if( v5 > 0xCu && a2[8] == 92 && a2[9] == 63 && a2[10] == 63 && a2[11] == 92 && a2[13] == 58 )
  {
    *(_DWORD *)(&LinkTarget.MaximumLength + 1) = 0;
    *(&ObjectAttributes.Length + 1) = 0;
    *(_OWORD *)SourceString = *(_OWORD *)L"\\??\\C:";
    *(&ObjectAttributes.Attributes + 1) = 0;
    LinkHandle = 0i64;
    RtlInitUnicodeString(&DestinationString, SourceString);
    DestinationString.Buffer[4] = a2[12];
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenSymbolicLinkObject(&LinkHandle, 1, &ObjectAttributes) >= 0 )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x208ui64, 538996553i64);
      v8 = PoolWithTag;
      if( !PoolWithTag )
      {
        ZwClose((_HANDLE)LinkHandle);
        return 0;
      }
      LinkTarget.Buffer = (wchar_t *)PoolWithTag;
      *(_DWORD *)&LinkTarget.Length = 34078720;
      v10 = ZwQuerySymbolicLinkObject(LinkHandle, &LinkTarget, 0i64);
      ZwClose((_HANDLE)LinkHandle);
      if( v10 >= 0
        && *LinkTarget.Buffer == 92
        && LinkTarget.Buffer[1] == 68
        && LinkTarget.Buffer[2] == 101
        && LinkTarget.Buffer[3] == 118
        && LinkTarget.Buffer[4] == 105
        && LinkTarget.Buffer[5] == 99
        && LinkTarget.Buffer[6] == 101
        && LinkTarget.Buffer[7] == 92
        && LinkTarget.Buffer[8] == 76
        && LinkTarget.Buffer[9] == 97
        && LinkTarget.Buffer[10] == 110
        && LinkTarget.Buffer[14] == 82
        && LinkTarget.Buffer[15] == 101
        && LinkTarget.Buffer[16] == 100
        && LinkTarget.Buffer[17] == 105
        && LinkTarget.Buffer[18] == 114
        && LinkTarget.Buffer[23] == 114
        && LinkTarget.Buffer[24] == 92 )
      {
        ExFreePoolWithTag(v8, 0);
        return 0;
      }
      ExFreePoolWithTag(v8, 0);
    }
  }
  v11 = a2[5];
  if( v11 < 0xCu )
    return 0;
  v12 = a2[8];
  if( v12 != 92 || a2[9] != 63 || a2[10] != 63 || a2[11] != 92 || a2[13] != 58 )
  {
    if( v11 != 96 && (v11 != 98 || a2[56] != 92) )
      return 0;
    if( v12 != 92 )
      return 0;
    v13 = a2[9];
    if( v13 != 63 && v13 != 92 )
      return 0;
    if( a2[10] != 63
      || a2[11] != 92
      || a2[12] != 86
      || a2[13] != 111
      || a2[14] != 108
      || a2[15] != 117
      || a2[16] != 109
      || a2[17] != 101
      || a2[18] != 123
      || a2[27] != 45
      || a2[32] != 45
      || a2[37] != 45
      || a2[42] != 45
      || a2[55] != 125 )
    {
      return 0;
    }
  }
  return 1;
}

Referenced by: