PiGetDriverMutableStateDirectory

INT64 __fastcall PiGetDriverMutableStateDirectory(INT64 a1, INT64 a2, _QWORD *a3){
  WCHAR v5; 
  int StateRootPath; 
  __int64 v7; 
  int v8; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING UnicodeString; 
  DestinationString = 0i64;
  UnicodeString = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64, (WCHAR)a3);
  RtlInitUnicodeString(&UnicodeString, 0i64, v5);
  StateRootPath = PiGetStateRootPath(L"Win32ServiceStateRoot");
  if( StateRootPath >= 0 )
  {
    v7 = -1i64;
    do
      ++v7;
    while( aData[v7] );
    if( DestinationString.Length
       + (unsigned int)*(unsigned __int16 *)(*(_QWORD *)(a1 + 48) + 24i64)
       + 4
       + 2 * (_DWORD)v7 <= 0xFFFE )
    {
      StateRootPath = IopAllocateUnicodeString(
                        &UnicodeString,
                        DestinationString.Length + *(_WORD *)(*(_QWORD *)(a1 + 48) + 24i64) + 4 + 2 * v7);
      if( StateRootPath >= 0 )
      {
        RtlUnicodeStringPrintfEx(&UnicodeString, 0i64, 0x800ui64, L"%wZ\\%wZ\\%ws");
        StateRootPath = v8;
        if( v8 >= 0 )
        {
          StateRootPath = PiOpenDirectoryWithRoot(&DestinationString, &UnicodeString);
          if( StateRootPath >= 0 )
            *a3 = 0i64;
        }
      }
    }
    else
    {
      StateRootPath = -2147483643;
    }
  }
  RtlFreeAnsiString(&DestinationString);
  RtlFreeAnsiString(&UnicodeString);
  return(unsigned int)StateRootPath;
}

Referenced by: