PiGetDriverImageDirectory

NTSTATUS __fastcall PiGetDriverImageDirectory(_DRIVER_OBJECT *DriverObject, VOID **a2, WCHAR a3){
  int v5; 
  unsigned int v6; 
  unsigned __int64 v7; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  _UNICODE_STRING DestinationString; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 

  FileHandle = 0i64;
  DestinationString = 0i64;
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  RtlInitUnicodeString(&DestinationString, 0i64);
  v5 = IoQueryFullDriverPath(DriverObject, &DestinationString);
  if( v5 >= 0 )
  {
    LOWORD(v6) = DestinationString.Length;
    if( DestinationString.Length < 2u )
      goto LABEL_9;
    while( 1 )
    {
      v6 = (unsigned __int16)(v6 - 2);
      DestinationString.Length = v6;
      v7 = (unsigned __int64)v6 >> 1;
      if( DestinationString.Buffer[v7] == 92 || DestinationString.Buffer[v7] == 47 )
        break;
      if( (unsigned __int16)v6 < 2u )
        goto LABEL_8;
    }
    DestinationString.Buffer[v7] = 0;
    LOWORD(v6) = DestinationString.Length;
LABEL_8:
    if( (unsigned __int16)v6 > 2u )
    {
      LODWORD(OpenOptions) = 33;
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      LODWORD(ShareAccess) = 3;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v5 = ZwOpenFile(&FileHandle, 0x100001ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
      if( v5 >= 0 )
      {
        *a2 = FileHandle;
        FileHandle = 0i64;
      }
    }
    else
    {
LABEL_9:
      v5 = -1073741811;
    }
  }
  RtlFreeAnsiString(&DestinationString);
  if( FileHandle )
    ZwClose((_HANDLE)FileHandle);
  return v5;
}

Referenced by: