BiResolveLocateDevice

VOID __fastcall BiResolveLocateDevice(UINT64 a1, UINT64 a2, UINT64 a3, UINT64 a4){
  __int64 v4; 
  UINT64 v5; 
  WCHAR *v8; 
  int v9; 
  UINT64 v10; 
  WCHAR *PoolWithTag; 
  WCHAR *v12; 
  __int64 v13; 
  __int64 v14; 
  SIZE_T NumberOfBytes; 
  struct _UNICODE_STRING Destination; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _FILE_BASIC_INFORMATION FileInformation; 
  v4 = *(unsigned int *)(a2 + 24);
  LODWORD(NumberOfBytes) = 0;
  v5 = a2 + v4;
  memset(&FileInformation, 0, sizeof(FileInformation));
  v8 = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  Destination = 0i64;
  if( *(_DWORD *)v5 == 2 )
  {
    v9 = *(_DWORD *)(a2 + 20);
    if( v9 )
    {
      if( v9 != 1 )
        goto LABEL_14;
      v12 = (WCHAR *)(a2 + 32);
    }
    else
    {
      v10 = *(unsigned int *)(a2 + 28);
      if( (v10 & 0xF000000) != 0x2000000 )
        goto LABEL_14;
      if( BcdGetElementData((PVOID)a1, v10, 0i64, &NumberOfBytes) != -1073741789 )
        goto LABEL_14;
      PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, (unsigned int)NumberOfBytes, 0x4B444342ui64);
      v8 = PoolWithTag;
      if( !PoolWithTag )
        goto LABEL_14;
      BcdGetElementData((PVOID)a1, *(unsigned int *)(a2 + 28), PoolWithTag, &NumberOfBytes);
      v12 = v8;
    }
    v13 = -1i64;
    v14 = -1i64;
    do
      ++v14;
    while( *(_WORD *)(v5 + 2 * v14 + 20) );
    do
      ++v13;
    while( v12[v13] );
    Destination.MaximumLength = 2 * (v13 + v14 + 1);
    Destination.Buffer = (wchar_t *)ExAllocatePoolWithTag(
                                      PagedPool,
                                      (unsigned __int16)(2 * (v14 + v13) + 2),
                                      0x4B444342ui64);
    if( !Destination.Buffer )
      goto LABEL_16;
    RtlAppendUnicodeToString(&Destination, (PWCHAR)(v5 + 20));
    RtlAppendUnicodeToString(&Destination, v12);
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &Destination;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    ZwQueryAttributesFile(&ObjectAttributes, &FileInformation);
  }
LABEL_14:
  if( Destination.Buffer )
    ExFreePoolWithTag(Destination.Buffer, 0x4B444342u);
LABEL_16:
  if( v8 )
    ExFreePoolWithTag(v8, 0x4B444342u);
}

Referenced by: