PiDrvDbQuerySystemPathWin32

NTSTATUS __stdcall PiDrvDbQuerySystemPathWin32(PCUNICODE_STRING String2, PUNICODE_STRING StringOut){
  _ADAPTER_OBJECT *v4; 
  _UNICODE_STRING *v5; 
  NTSTATUS v6; 
  NTSTATUS Node; 
  NTSTATUS FileDosDeviceName; 
  unsigned __int16 Length; 
  unsigned __int16 v10; 
  unsigned __int16 v11; 
  wchar_t *Buffer; 
  wchar_t *v13; 
  unsigned __int16 v14; 
  bool v15; 
  unsigned __int16 v16; 
  unsigned __int64 v17; 
  wchar_t *v18; 
  int v19; 
  int v20; 
  _UNICODE_STRING *v21; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  _UNICODE_STRING DestinationString; 
  PVOID Object; 
  _UNICODE_STRING v27; 
  _UNICODE_STRING String2a; 
  _UNICODE_STRING *v29; 
  _UNICODE_STRING Source; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int64 v33[14]; 
  int v34; 
  _UNICODE_STRING *StringIn; 
  VOID *FileHandle; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  FileHandle = 0i64;
  StringIn = 0i64;
  Object = 0i64;
  IoStatusBlock = 0i64;
  v4 = 0i64;
  v34 = 0;
  v5 = 0i64;
  v29 = 0i64;
  String2a = 0i64;
  DestinationString = 0i64;
  v27 = 0i64;
  Source = 0i64;
  RtlInitUnicodeString(StringOut, 0i64);
  RtlInitUnicodeString(&DestinationString, 0i64);
  RtlInitUnicodeString(&v27, 0i64);
  LODWORD(OpenOptions) = 33;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)String2;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(ShareAccess) = 3;
  if( ZwOpenFile(&FileHandle, 0x100080ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions) >= 0 )
  {
    Object = 0i64;
    v6 = ObReferenceObjectByHandle(FileHandle, 0x80ui64, (_OBJECT_TYPE *)IoFileObjectType, 0, &Object, 0i64);
    v4 = (_ADAPTER_OBJECT *)Object;
    Node = v6;
    if( v6 >= 0 )
    {
      FileDosDeviceName = IoQueryFileDosDeviceName((_FILE_OBJECT *)Object, (_OBJECT_NAME_INFORMATION **)&StringIn);
      v5 = StringIn;
      Node = FileDosDeviceName;
      if( FileDosDeviceName >= 0 )
        Node = RtlDuplicateUnicodeString(1ui64, StringIn, StringOut);
    }
    goto LABEL_39;
  }
  Length = String2->Length;
  if( String2->Length >= 0x16u && (unsigned __int8)RtlPrefixUnicodeString(&PiDrvDbSystemRootNt, String2, 1u) )
  {
    RtlInitUnicodeString(&String2a, L"SYSTEM");
    v10 = String2->Length;
    if( String2->Length > 0x18u && String2->Buffer[11] == 92 )
    {
      v27.Buffer = String2->Buffer + 11;
      v11 = v10 - 22;
LABEL_18:
      v27.Length = v11;
      v27.MaximumLength = v11 + 2;
      goto LABEL_21;
    }
  }
  else if( Length > 0x1Cu
         && (unsigned __int8)RtlPrefixUnicodeString(&PiDrvDbDriverStoresRoot, String2, 1u)
         && (Buffer = String2->Buffer, Buffer[13] == 92) )
  {
    v13 = Buffer + 14;
    v14 = 0;
    v15 = Buffer[14] == 92;
    String2a.Buffer = Buffer + 14;
    if( !v15 )
    {
      do
      {
        if( !v13[v14] )
          break;
        ++v14;
      }
      while( v13[v14] != 92 );
    }
    v16 = 2 * v14;
    v17 = (unsigned __int64)v16 >> 1;
    String2a.Length = v16;
    String2a.MaximumLength = v16;
    v18 = &v13[v17];
    if( *v18 == 92 )
    {
      v27.Buffer = &v13[v17];
      v11 = Length - 2 * (v18 - Buffer);
      goto LABEL_18;
    }
  }
  else
  {
    RtlInitUnicodeString(&String2a, L"SYSTEM");
  }
  v11 = v27.Length;
LABEL_21:
  Node = PiDrvDbFindNode(&String2a);
  if( Node < 0 )
    goto LABEL_39;
  v19 = *((_DWORD *)Object + 16);
  if( (v19 & 1) != 0 )
  {
    RtlInitUnicodeString(&Source, L"C:\\Windows");
    DestinationString.MaximumLength = v11 + Source.Length + 2;
    DestinationString.Buffer = (wchar_t *)ExpAllocateStringRoutine(DestinationString.MaximumLength);
    if( !DestinationString.Buffer )
      goto LABEL_24;
    Node = RtlAppendUnicodeStringToString(&DestinationString, &Source);
    if( Node < 0 )
      goto LABEL_39;
    if( InitIsWinPEMode )
    {
      memset(v33, 0i64, sizeof(v33));
      LODWORD(v33[4]) = 0x4000000;
      LODWORD(v33[1]) = 292;
      v33[2] = (__int64)L"InstRootDrive";
      v33[3] = (__int64)&v34;
      LOBYTE(v20) = RtlpQueryRegistryValues((_KTRAP_FRAME *)2, (_KEXCEPTION_FRAME *)&stru_1407D2340);
      Node = v20;
      if( v20 < 0 || (unsigned int)(v34 - 65) > 0x19 )
      {
        Node = 0;
        *DestinationString.Buffer = 88;
      }
      else
      {
        *DestinationString.Buffer = v34;
      }
    }
  }
  else
  {
    if( (v19 & 8) == 0 )
    {
      Node = -1073741275;
      goto LABEL_39;
    }
    Node = PiDrvDbGetNodeSystemRoot((__int64)Object, &v29);
    if( Node < 0 )
      goto LABEL_39;
    v21 = v29;
    DestinationString.MaximumLength = v29->Length + v11 + 2;
    DestinationString.Buffer = (wchar_t *)ExpAllocateStringRoutine(DestinationString.MaximumLength);
    if( !DestinationString.Buffer )
    {
LABEL_24:
      Node = -1073741670;
      goto LABEL_39;
    }
    Node = RtlAppendUnicodeStringToString(&DestinationString, v21);
    if( Node < 0 )
      goto LABEL_39;
  }
  if( v11 <= 2u || (Node = RtlAppendUnicodeStringToString(&DestinationString, &v27), Node >= 0) )
  {
    *StringOut = DestinationString;
    RtlInitUnicodeString(&DestinationString, 0i64);
  }
LABEL_39:
  RtlFreeAnsiString(&DestinationString);
  if( v5 )
    ExFreePoolWithTag(v5, 0);
  if( v4 )
    HalPutDmaAdapter(v4);
  if( FileHandle )
    ZwClose((_HANDLE)FileHandle);
  return Node;
}

Referenced by: