PiGetDriverImageDirectory

INT64 __stdcall PiGetDriverImageDirectory(DRIVER_OBJECT *DriverObject, UINT64 *a2){
  WCHAR v2; 
  NTSTATUS v5; 
  unsigned int v6; 
  unsigned __int64 v7; 
  struct _UNICODE_STRING DestinationString; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UNICODE_STRING FileHandle; 
  *(_QWORD *)&FileHandle.Length = 0i64;
  DestinationString = 0i64;
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  RtlInitUnicodeString(&DestinationString, 0i64, v2);
  v5 = IoQueryFullDriverPath(DriverObject, &DestinationString);
  if( v5 >= 0 )
  {
    LOWORD(v6) = DestinationString.Length;
    if( DestinationString.Length < 2u )
      goto LABEL_9;
    while( 1 )
    {
      v6 = (unsigned __int16)(v6 - 2);
      DestinationString.Length = v6;
      v7 = (unsigned __int64)v6 >> 1;
      if( DestinationString.Buffer[v7] == 92 || DestinationString.Buffer[v7] == 47 )
        break;
      if( (unsigned __int16)v6 < 2u )
        goto LABEL_8;
    }
    DestinationString.Buffer[v7] = 0;
    LOWORD(v6) = DestinationString.Length;
LABEL_8:
    if( (unsigned __int16)v6 > 2u )
    {
      ObjectAttributes.ObjectName = &DestinationString;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v5 = ZwOpenFile(&FileHandle, (PWCHAR)0x100001);
      if( v5 >= 0 )
      {
        *a2 = *(_QWORD *)&FileHandle.Length;
        *(_QWORD *)&FileHandle.Length = 0i64;
      }
    }
    else
    {
LABEL_9:
      v5 = -1073741811;
    }
  }
  RtlFreeAnsiString(&DestinationString);
  if( *(_QWORD *)&FileHandle.Length )
    ZwClose(*(HANDLE *)&FileHandle.Length);
  return(unsigned int)v5;
}

Referenced by: