PspInitializeFullProcessImageName

NTSTATUS __stdcall PspInitializeFullProcessImageName(PSP_CREATE_PROCESS_CONTEXT *CreateContext, _EPROCESS *Process){
  _OBJECT_NAME_INFORMATION *v4; 
  _FILE_OBJECT *v5; 
  NTSTATUS v6; 
  int v7; 
  VOID **v8; 
  VOID **PoolWithTag; 
  VOID **v11; 
  _SECTION *SectionObject; 
  _CONTROL_AREA *v13; 
  UINT64 ReturnLength; 
  _UNICODE_STRING ProcessName; 
  VOID *Src[34]; 

  memset(Src, 0i64, sizeof(Src));
  v4 = 0i64;
  if( (Process->Flags3 & 1) != 0 )
    goto LABEL_17;
  if( CreateContext )
  {
    v5 = (_FILE_OBJECT *)*((_QWORD *)CreateContext + 22);
  }
  else
  {
    SectionObject = (_SECTION *)Process->SectionObject;
    if( !SectionObject )
    {
      v7 = -1073741637;
      goto LABEL_11;
    }
    v13 = MiSectionControlArea(SectionObject);
    v5 = MiReferenceControlAreaFile(v13);
  }
  ProcessName = v5->FileName;
  PspSetProcessShortName(Process, &ProcessName);
  LODWORD(ReturnLength) = 272;
  v6 = ObQueryNameStringMode(v5, (_OBJECT_NAME_INFORMATION *)Src, 0x110ui64, &ReturnLength, 0);
  v7 = v6;
  if( v6 == -2147483643 || v6 == -1073741789 || v6 == -1073741820 )
  {
    if( (unsigned int)ReturnLength <= 0x110 )
      goto LABEL_17;
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, (unsigned int)ReturnLength, 1850307408i64);
    v4 = (_OBJECT_NAME_INFORMATION *)PoolWithTag;
    if( !PoolWithTag )
      goto LABEL_17;
    v7 = ObQueryNameStringMode(
           v5,
           (_OBJECT_NAME_INFORMATION *)PoolWithTag,
           (unsigned int)ReturnLength,
           &ReturnLength,
           0);
    if( v7 >= 0 )
      goto LABEL_12;
    ExFreePoolWithTag(v4, 0);
LABEL_11:
    if( v7 >= 0 )
      goto LABEL_12;
    goto LABEL_17;
  }
  if( v6 >= 0 && (unsigned int)(ReturnLength - 17) <= 0xFF )
  {
    v8 = ExAllocatePoolWithTag(0x200ui64, (unsigned int)ReturnLength, 1850307408i64);
    v4 = (_OBJECT_NAME_INFORMATION *)v8;
    if( v8 )
    {
      *(_OWORD *)v8 = *(_OWORD *)Src;
      v8[1] = v8 + 2;
      memmove(v8 + 2, Src[1], WORD1(Src[0]));
      goto LABEL_11;
    }
  }
LABEL_17:
  LODWORD(ReturnLength) = 16;
  v11 = ExAllocatePoolWithTag(0x200ui64, 0x10ui64, 1850307408i64);
  v4 = (_OBJECT_NAME_INFORMATION *)v11;
  if( v11 )
  {
    memset(v11, 0i64, ReturnLength);
    v7 = 0;
  }
  else
  {
    v7 = -1073741801;
  }
LABEL_12:
  Process->SeAuditProcessCreationInfo.ImageFileName = v4;
  return v7;
}

Referenced by: