XpressStandardDecompressBuffer

ULONG XpressStandardDecompressBuffer(_In_ PBYTE CompressedBuffer, _In_ ULONG SizeOfCompressedBufferInBytes, _Inout_ PBYTE DecompressedBuffer, _In_ ULONG DecompressedBufferSizeInBytes)
{
	typedef NTSTATUS(NTAPI* RTLDECOMPRESSBUFFER)(USHORT, PUCHAR, ULONG, PUCHAR, ULONG, PULONG);
	RTLDECOMPRESSBUFFER RtlDecompressBuffer = NULL;
	HMODULE hMod = NULL;
	NTSTATUS Status = STATUS_SUCCESS;
	USHORT CompressionFormatAndEngine = COMPRESSION_FORMAT_XPRESS | COMPRESSION_ENGINE_STANDARD;
	ULONG FinalDecompressedSize = 0;

	hMod = GetModuleHandleW(L"ntdll.dll");
	if (hMod == NULL)
		goto EXIT_ROUTINE;

	RtlDecompressBuffer = (RTLDECOMPRESSBUFFER)GetProcAddress(hMod, "RtlDecompressBuffer");
	if (!RtlDecompressBuffer)
		goto EXIT_ROUTINE;

	Status = RtlDecompressBuffer(CompressionFormatAndEngine, DecompressedBuffer, DecompressedBufferSizeInBytes, CompressedBuffer, SizeOfCompressedBufferInBytes, &FinalDecompressedSize);
	if (Status != STATUS_SUCCESS)
		goto EXIT_ROUTINE;

EXIT_ROUTINE:

	return FinalDecompressedSize;
}