PiControlGetDeviceStack

__int64 __fastcall PiControlGetDeviceStack(__int64 a1, int a2, __int64 a3, unsigned int *a4){
  DEVICE_OBJECT *v4; 
  unsigned int v5; 
  int v7; 
  _OBJECT_NAME_INFORMATION *v8; 
  _DEVICE_OBJECT *DeviceAttachmentBaseRefWithTag; 
  VOID *LowerDeviceObjectWithTag; 
  void *v11; 
  PVOID *PoolWithTag; 
  PVOID *v13; 
  PVOID *v14; 
  unsigned int v15; 
  UINT8 *v16; 
  int v17; 
  __int64 v18; 
  unsigned __int16 Length; 
  UINT8 *v20; 
  unsigned int v21; 
  PVOID *v22; 
  __int64 v23; 
  UINT64 v25; 
  WCHAR v26; 
  unsigned int v27; 
  _DEVICE_OBJECT *Object; 
  PVOID P; 
  PVOID *p_P; 
  _OBJECT_NAME_INFORMATION Src; 
  UINT64 ReturnLength; 
  int v33; 
  __int64 v34; 
  unsigned int *v35; 
  v35 = a4;
  v34 = a3;
  v33 = a2;
  v4 = *(DEVICE_OBJECT **)(a1 + 32);
  p_P = &P;
  LODWORD(ReturnLength) = 0;
  v5 = a2;
  P = &P;
  v7 = 0;
  v8 = 0i64;
  Src = 0i64;
  DeviceAttachmentBaseRefWithTag = IoGetDeviceAttachmentBaseRefWithTag(v4, 0x43706E50ui64);
  Object = DeviceAttachmentBaseRefWithTag;
  if( !DeviceAttachmentBaseRefWithTag )
  {
    v7 = -1073741808;
    goto LABEL_27;
  }
  LODWORD(LowerDeviceObjectWithTag) = IoGetAttachedDeviceReferenceWithTag(DeviceAttachmentBaseRefWithTag, 0x43706E50u);
  while( 1 )
  {
    v11 = LowerDeviceObjectWithTag;
    if( !LowerDeviceObjectWithTag )
      break;
    PoolWithTag = (PVOID *)ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x47706E50ui64);
    if( !PoolWithTag )
    {
      ObfDereferenceObjectWithTag(v11, 0x43706E50ui64);
      v7 = -1073741670;
      goto LABEL_27;
    }
    PoolWithTag[2] = v11;
    v13 = p_P;
    if( *p_P != &P )
LABEL_35:
      __fastfail(3u);
    PoolWithTag[1] = p_P;
    *PoolWithTag = &P;
    *v13 = PoolWithTag;
    p_P = PoolWithTag;
    LowerDeviceObjectWithTag = IoGetLowerDeviceObjectWithTag((INT64)v11, 0x43706E50ui64);
  }
  v14 = (PVOID *)P;
  v15 = v5;
  v27 = v5;
  v16 = (UINT8 *)a3;
  v17 = 0;
  if( P == &P )
  {
LABEL_20:
    if( v16 && v15 >= 2 )
      *(_WORD *)v16 = 0;
    v21 = v17 + 2;
    *v35 = v21;
    if( !v34 || v21 > v5 )
      v7 = -1073741789;
    goto LABEL_25;
  }
  while( 1 )
  {
    v18 = *((_QWORD *)v14[2] + 1);
    if( v18 )
      break;
    RtlInitUnicodeString(&Src.Name, L"?", 2u);
LABEL_50:
    Length = Src.Name.Length;
LABEL_14:
    if( v16 && v27 >= (unsigned __int64)Length + 2 )
    {
      memmove(v16, (UINT8 *)Src.Name.Buffer, Length);
      v20 = &v16[2 * ((unsigned __int64)Length >> 1)];
      *(_WORD *)v20 = 0;
      v16 = v20 + 2;
      v27 += -2 - Length;
    }
    v14 = (PVOID *)*v14;
    v17 += Length + 2;
    if( v14 == &P )
      goto LABEL_18;
  }
  if( *(_QWORD *)(v18 + 64) && *(_WORD *)(v18 + 56) >= 2u )
  {
    Length = _mm_cvtsi128_si32(*(__m128i *)(v18 + 56));
    Src = *(_OBJECT_NAME_INFORMATION *)(v18 + 56);
    for( Src.Name.Length = Length; Length >= 2u; Src.Name.Length = Length )
    {
      if( Src.Name.Buffer[((unsigned __int64)Length >> 1) - 1] )
        break;
      Length -= 2;
    }
  }
  else
  {
    RtlInitUnicodeString(&Src.Name, 0i64, 2u);
    Length = Src.Name.Length;
  }
  if( Length )
    goto LABEL_14;
  v25 = 272i64;
  LODWORD(ReturnLength) = 272;
  if( v8 )
  {
LABEL_44:
    v7 = ObQueryNameString((VOID *)v18, v8, v25, &ReturnLength);
    if( v7 >= 0 && (_DWORD)ReturnLength && (v26 = 2, v8->Name.Length >= 2u) )
    {
      Src = *v8;
    }
    else
    {
      RtlInitUnicodeString(&Src.Name, L"?", v26);
      v7 = 0;
    }
    goto LABEL_50;
  }
  v8 = (_OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(PagedPool, 0x110ui64, 0x47706E50ui64);
  if( v8 )
  {
    v25 = (unsigned int)ReturnLength;
    goto LABEL_44;
  }
  v7 = -1073741670;
LABEL_18:
  if( v7 >= 0 )
  {
    v15 = v27;
    v5 = v33;
    goto LABEL_20;
  }
LABEL_25:
  if( v8 )
    ExFreePoolWithTag(v8, 0);
LABEL_27:
  while( 1 )
  {
    v22 = (PVOID *)P;
    if( P == &P )
      break;
    if( *((PVOID **)P + 1) != &P )
      goto LABEL_35;
    v23 = *(_QWORD *)P;
    if( *(PVOID *)(*(_QWORD *)P + 8i64) != P )
      goto LABEL_35;
    P = *(PVOID *)P;
    *(_QWORD *)(v23 + 8) = &P;
    ObfDereferenceObjectWithTag(v22[2], 0x43706E50ui64);
    ExFreePoolWithTag(v22, 0);
  }
  if( Object )
    ObfDereferenceObjectWithTag(Object, 0x43706E50ui64);
  return(unsigned int)v7;
}

Referenced by: