IoGetDeviceDirectory

__int64 __fastcall IoGetDeviceDirectory(__int64 a1, int a2, int a3, __int64 a4, _QWORD *arg20){
  INT64 v7; 
  wchar_t *v8; 
  __int64 v11; 
  NTSTATUS StateRootPath; 
  int ObjectProperty; 
  __int64 v14; 
  unsigned __int64 v15; 
  unsigned int v16; 
  __int64 v17; 
  __int64 v18; 
  int v19; 
  unsigned __int16 Length; 
  int v21; 
  __int64 v22; 
  wchar_t *Buffer; 
  NTSTATUS v24; 
  INT64 v26; 
  INT64 a5; 
  _UNICODE_STRING UnicodeString; 
  _UNICODE_STRING DestinationString; 
  PCWSTR SourceString; 
  _UNICODE_STRING GuidString; 
  _UNICODE_STRING v32; 
  UUID Uuid; 

  v7 = 0i64;
  a5 = 0i64;
  v8 = 0i64;
  v26 = 0i64;
  SourceString = 0i64;
  DestinationString = 0i64;
  GuidString = 0i64;
  Uuid = 0i64;
  UnicodeString = 0i64;
  v32 = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  RtlInitUnicodeString(&GuidString, 0i64);
  RtlInitUnicodeString(&UnicodeString, 0i64);
  RtlInitUnicodeString(&v32, 0i64);
  if( !a1
    || a3
    || a4
    || !arg20
    || (v11 = *(_QWORD *)(*(_QWORD *)(a1 + 312) + 40i64)) == 0
    || !*(_WORD *)(v11 + 40)
    || !*(_QWORD *)(v11 + 48)
    || a2 )
  {
    StateRootPath = -1073741811;
    goto LABEL_46;
  }
  StateRootPath = PiGetStateRootPath(L"DriverState");
  if( StateRootPath < 0 )
    goto LABEL_46;
  ObjectProperty = PnpGetObjectProperty(
                     0x6F697050u,
                     0x4Eui64,
                     *(_QWORD *)(v11 + 48),
                     1u,
                     0i64,
                     0i64,
                     (INT64)&DEVPKEY_Device_StateDirectoryId,
                     (INT64)&v26 + 4,
                     (__int64)&SourceString,
                     (__int64)&v26);
  v8 = (wchar_t *)SourceString;
  v14 = -1i64;
  StateRootPath = ObjectProperty;
  if( ObjectProperty >= 0 )
  {
    if( HIDWORD(v26) == 18 && (unsigned int)v26 >= 2 )
    {
      v15 = -1i64;
      do
        ++v15;
      while( SourceString[v15] );
      v16 = 0;
      if( v15 )
      {
        v17 = 0i64;
        do
        {
          v18 = SourceString[v17];
          if( (unsigned int)v18 > 0x7F || (*((_BYTE *)qword_140011770 + v18) & 1) == 0 )
            goto LABEL_26;
          v17 = ++v16;
        }
        while( v16 < v15 );
      }
    }
    else
    {
      StateRootPath = -1073741275;
    }
    if( StateRootPath >= 0 )
    {
      StateRootPath = RtlInitUnicodeStringEx(&v32, (WCHAR *)SourceString);
      if( StateRootPath < 0 )
        goto LABEL_46;
      v19 = PiBuildAndOpenDeviceDirectoryPath(&DestinationString, &v32.Length, (INT64)L"Data", 1, (INT64)&a5);
LABEL_42:
      StateRootPath = v19;
      if( v19 >= 0 )
      {
        v7 = 0i64;
        *arg20 = a5;
        goto LABEL_46;
      }
      goto LABEL_44;
    }
  }
  if( StateRootPath != -1073741275 )
    goto LABEL_46;
LABEL_26:
  StateRootPath = PnpConcatenateUnicodeStrings(&UnicodeString, (_UNICODE_STRING *)(v11 + 40));
  if( StateRootPath >= 0 )
  {
    Length = UnicodeString.Length;
    v21 = 0;
    if( (UnicodeString.Length & 0xFFFE) != 0 )
    {
      while( 1 )
      {
        v22 = UnicodeString.Buffer[v21];
        if( (unsigned int)v22 > 0x7F )
          break;
        if( (*((_BYTE *)qword_140011770 + v22) & 1) == 0 )
        {
          UnicodeString.Buffer[v21] = (*((_BYTE *)qword_140011770 + v22) & 1) + 35;
          Length = UnicodeString.Length;
        }
        if( ++v21 >= (unsigned int)(Length >> 1) )
          goto LABEL_34;
      }
      StateRootPath = -1073741811;
    }
LABEL_34:
    if( StateRootPath >= 0 )
    {
      Buffer = UnicodeString.Buffer;
      v24 = PiBuildAndOpenDeviceDirectoryPath(&DestinationString, &UnicodeString.Length, (INT64)L"Data", 0, (INT64)&a5);
      StateRootPath = v24;
      if( v24 == -1073741766 )
      {
        StateRootPath = ExUuidCreate(&Uuid);
        if( StateRootPath < 0 )
          goto LABEL_44;
        StateRootPath = RtlStringFromGUIDEx(&Uuid, &GuidString, 1u);
        if( StateRootPath < 0 )
          goto LABEL_44;
        Buffer = GuidString.Buffer;
        v24 = PiBuildAndOpenDeviceDirectoryPath(&DestinationString, &GuidString.Length, (INT64)L"Data", 1, (INT64)&a5);
        StateRootPath = v24;
      }
      if( v24 >= 0 )
      {
        do
          ++v14;
        while( Buffer[v14] );
        v19 = PnpSetObjectProperty(
                *(&stru_140CF2E80 + 607),
                *(_QWORD *)(v11 + 48),
                1u,
                0i64,
                0i64,
                (__int64)&DEVPKEY_Device_StateDirectoryId,
                18,
                (__int64)Buffer,
                2 * (int)v14 + 2,
                0);
        goto LABEL_42;
      }
LABEL_44:
      v7 = a5;
    }
  }
LABEL_46:
  RtlFreeAnsiString(&DestinationString);
  RtlFreeAnsiString(&GuidString);
  RtlFreeAnsiString(&UnicodeString);
  if( v8 )
    ExFreePoolWithTag(v8, 0x6F697050u);
  if( v7 )
    ZwClose(v7);
  return(unsigned int)StateRootPath;
}

Referenced by: