PiControlGetDeviceStack

NTSTATUS __stdcall PiControlGetDeviceStack(
        _DEVICE_NODE *DeviceNode,
        UINT64 BufferSize,
        VOID *Buffer,
        UINT64 *RequiredSize,
        INT64 s27){
  _DEVICE_OBJECT *PhysicalDeviceObject; 
  unsigned int v6; 
  int NameString; 
  VOID **v9; 
  _DEVICE_OBJECT *DeviceAttachmentBaseRefWithTag; 
  VOID *LowerDeviceObjectWithTag; 
  VOID *v12; 
  VOID **PoolWithTag; 
  _QWORD *v14; 
  PVOID *v15; 
  unsigned int v16; 
  _WORD *v17; 
  int v18; 
  __int64 v19; 
  unsigned __int16 Length; 
  _WORD *v21; 
  unsigned int v22; 
  VOID **v23; 
  __int64 v24; 
  UINT64 v26; 
  unsigned int v27; 
  _DEVICE_OBJECT *Object; 
  PVOID P; 
  PVOID *p_P; 
  _UNICODE_STRING Src; 
  PULONG ReturnLength; 
  unsigned int v33; 
  VOID *v34; 
  UINT64 *v35; 

  v35 = RequiredSize;
  v34 = Buffer;
  v33 = BufferSize;
  PhysicalDeviceObject = DeviceNode->PhysicalDeviceObject;
  p_P = &P;
  LODWORD(ReturnLength) = 0;
  v6 = BufferSize;
  P = &P;
  NameString = 0;
  v9 = 0i64;
  Src = 0i64;
  DeviceAttachmentBaseRefWithTag = IoGetDeviceAttachmentBaseRefWithTag(PhysicalDeviceObject, 0x43706E50ui64);
  Object = DeviceAttachmentBaseRefWithTag;
  if( !DeviceAttachmentBaseRefWithTag )
  {
    NameString = -1073741808;
    goto LABEL_27;
  }
  LODWORD(LowerDeviceObjectWithTag) = IoGetAttachedDeviceReferenceWithTag(DeviceAttachmentBaseRefWithTag, 0x43706E50u);
  while( 1 )
  {
    v12 = LowerDeviceObjectWithTag;
    if( !LowerDeviceObjectWithTag )
      break;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x18ui64, 1198550608i64);
    if( !PoolWithTag )
    {
      ObfDereferenceObjectWithTag(v12, 0x43706E50ui64);
      NameString = -1073741670;
      goto LABEL_27;
    }
    PoolWithTag[2] = v12;
    v14 = p_P;
    if( *p_P != &P )
LABEL_35:
      __fastfail(3u);
    PoolWithTag[1] = p_P;
    *PoolWithTag = &P;
    *v14 = PoolWithTag;
    p_P = PoolWithTag;
    LowerDeviceObjectWithTag = IoGetLowerDeviceObjectWithTag((INT64)v12, 0x43706E50ui64);
  }
  v15 = (PVOID *)P;
  v16 = v6;
  v27 = v6;
  v17 = Buffer;
  v18 = 0;
  if( P == &P )
  {
LABEL_20:
    if( v17 && v16 >= 2 )
      *v17 = 0;
    v22 = v18 + 2;
    *(_DWORD *)v35 = v22;
    if( !v34 || v22 > v6 )
      NameString = -1073741789;
    goto LABEL_25;
  }
  while( 1 )
  {
    v19 = *((_QWORD *)v15[2] + 1);
    if( v19 )
      break;
    RtlInitUnicodeString(&Src, L"?");
LABEL_50:
    Length = Src.Length;
LABEL_14:
    if( v17 && v27 >= (unsigned __int64)Length + 2 )
    {
      memmove(v17, Src.Buffer, Length);
      v21 = &v17[(unsigned __int64)Length >> 1];
      *v21 = 0;
      v17 = v21 + 1;
      v27 += -2 - Length;
    }
    v15 = (PVOID *)*v15;
    v18 += Length + 2;
    if( v15 == &P )
      goto LABEL_18;
  }
  if( *(_QWORD *)(v19 + 64) && *(_WORD *)(v19 + 56) >= 2u )
  {
    Length = _mm_cvtsi128_si32(*(__m128i *)(v19 + 56));
    Src = *(_UNICODE_STRING *)(v19 + 56);
    for( Src.Length = Length; Length >= 2u; Src.Length = Length )
    {
      if( Src.Buffer[((unsigned __int64)Length >> 1) - 1] )
        break;
      Length -= 2;
    }
  }
  else
  {
    RtlInitUnicodeString(&Src, 0i64);
    Length = Src.Length;
  }
  if( Length )
    goto LABEL_14;
  v26 = 272i64;
  LODWORD(ReturnLength) = 272;
  if( v9 )
  {
LABEL_44:
    NameString = ObQueryNameString((VOID *)v19, (_OBJECT_NAME_INFORMATION *)v9, v26, (UINT64 *)&ReturnLength);
    if( NameString >= 0 && (_DWORD)ReturnLength && *(_WORD *)v9 >= 2u )
    {
      Src = *(_UNICODE_STRING *)v9;
    }
    else
    {
      RtlInitUnicodeString(&Src, L"?");
      NameString = 0;
    }
    goto LABEL_50;
  }
  v9 = ExAllocatePoolWithTag(1ui64, 0x110ui64, 1198550608i64);
  if( v9 )
  {
    v26 = (unsigned int)ReturnLength;
    goto LABEL_44;
  }
  NameString = -1073741670;
LABEL_18:
  if( NameString >= 0 )
  {
    v16 = v27;
    v6 = v33;
    goto LABEL_20;
  }
LABEL_25:
  if( v9 )
    ExFreePoolWithTag(v9, 0);
LABEL_27:
  while( 1 )
  {
    v23 = (VOID **)P;
    if( P == &P )
      break;
    if( *((PVOID **)P + 1) != &P )
      goto LABEL_35;
    v24 = *(_QWORD *)P;
    if( *(PVOID *)(*(_QWORD *)P + 8i64) != P )
      goto LABEL_35;
    P = *(PVOID *)P;
    *(_QWORD *)(v24 + 8) = &P;
    ObfDereferenceObjectWithTag(v23[2], 0x43706E50ui64);
    ExFreePoolWithTag(v23, 0);
  }
  if( Object )
    ObfDereferenceObjectWithTag(Object, 0x43706E50ui64);
  return NameString;
}

Referenced by: