PiDevCfgBuildIndirectString

__int64 __fastcall PiDevCfgBuildIndirectString(
        __int64 a1,
        unsigned __int16 *a2,
        __int64 a3,
        struct _UNICODE_STRING *a4){
  unsigned __int64 v4; 
  unsigned int v9; 
  unsigned int *v10; 
  _WORD *v11; 
  unsigned __int16 v12; 
  unsigned __int64 v13; 
  wchar_t *StringRoutine; 
  WCHAR *v15; 
  NTSTATUS RegistryValue; 
  UINT64 v17; 
  WCHAR *v18; 
  unsigned int v19; 
  WCHAR v20; 
  int v21; 
  unsigned __int16 Length; 
  int v23; 
  int v24; 
  __int64 v25; 
  struct _UNICODE_STRING v26; 
  void *KeyHandle; 
  struct _UNICODE_STRING DestinationString; 
  __int128 v30; 
  struct _UNICODE_STRING RemainingString; 
  struct _UNICODE_STRING UnicodeString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID P; 
  v4 = *a2;
  KeyHandle = 0i64;
  P = 0i64;
  *(_QWORD *)&DestinationString.Length = 0i64;
  DestinationString.Buffer = 0i64;
  v9 = 0;
  v10 = 0i64;
  RemainingString = 0i64;
  v30 = 0i64;
  UnicodeString = 0i64;
  if( (unsigned int)v4 <= 4 || (v11 = (_WORD *)*((_QWORD *)a2 + 1), *v11 != 37) || v11[(v4 >> 1) - 1] != 37 )
  {
    if( PnpDuplicateUnicodeString((UNICODE_STRING *)a3, (UNICODE_STRING *)a2) )
    {
      if( a4 )
        *a4 = *(struct _UNICODE_STRING *)a3;
      goto LABEL_19;
    }
    goto LABEL_24;
  }
  *(_DWORD *)&RemainingString.Length = 1048590;
  RemainingString.Buffer = L"Strings";
  ObjectAttributes.RootDirectory = *(void **)(a1 + 16);
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  ObjectAttributes.ObjectName = &RemainingString;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0 )
  {
    v12 = *a2 - 4;
    v13 = v12;
    UnicodeString.Length = v12;
    UnicodeString.MaximumLength = v12 + 2;
    StringRoutine = (wchar_t *)ExpAllocateStringRoutine((unsigned __int16)(v12 + 2));
    UnicodeString.Buffer = StringRoutine;
    v15 = StringRoutine;
    if( !StringRoutine )
      goto LABEL_24;
    memmove((UINT8 *)StringRoutine, (UINT8 *)(*((_QWORD *)a2 + 1) + 2i64), (unsigned int)v13);
    v15[v13 >> 1] = 0;
    RegistryValue = IopGetRegistryValue(KeyHandle, v15, 0i64, (KEY_VALUE_FULL_INFORMATION **)&P);
    RtlFreeAnsiString(&UnicodeString);
    if( RegistryValue >= 0 )
    {
      v10 = (unsigned int *)P;
      if( PnpValidateRegistryString((KEY_VALUE_FULL_INFORMATION *)P) )
      {
        v17 = v10[3];
        v18 = (WCHAR *)((char *)v10 + v10[2]);
        LODWORD(P) = 0;
        PnpRegSzToString(v18, v17, (UINT64 *)&P);
        LOWORD(v30) = (_WORD)P;
        WORD1(v30) = *((_WORD *)v10 + 6);
        *((_QWORD *)&v30 + 1) = (char *)v10 + v10[2];
      }
      else
      {
        ExFreePoolWithTag(v10, 0);
        v10 = 0i64;
      }
    }
  }
  v19 = *(unsigned __int16 *)(a1 + 40) + *a2 + 4;
  if( *((_QWORD *)&v30 + 1) )
    v19 += (unsigned __int16)v30 + 2;
  if( (unsigned __int64)v19 + 2 > 0xFFFE )
  {
    v9 = -1073741562;
    goto LABEL_19;
  }
  DestinationString.Length = v19;
  DestinationString.MaximumLength = v19 + 2;
  DestinationString.Buffer = (wchar_t *)ExpAllocateStringRoutine((unsigned __int16)(v19 + 2));
  if( !DestinationString.Buffer )
  {
LABEL_24:
    v9 = -1073741670;
    goto LABEL_19;
  }
  RtlUnicodeStringPrintfEx(&DestinationString, &RemainingString, 0x800ui64, L"@%wZ,%wZ");
  v9 = v21;
  if( v21 < 0 )
    goto LABEL_19;
  Length = DestinationString.Length;
  v23 = DestinationString.Length >> 1;
  if( *((_QWORD *)&v30 + 1) )
  {
    RtlUnicodeStringPrintf(&RemainingString, L";%wZ", &v30);
    v9 = v24;
    if( v24 < 0 )
      goto LABEL_19;
    DestinationString.Length = RemainingString.Length + Length;
    v25 = (unsigned int)(v23 + 1);
  }
  else
  {
    v25 = v23 - (*a2 >> 1);
  }
  v26 = DestinationString;
  DestinationString = 0i64;
  *(struct _UNICODE_STRING *)a3 = v26;
  if( a4 )
    RtlInitUnicodeString(a4, (PCWSTR)(*(_QWORD *)(a3 + 8) + 2 * v25), v20);
LABEL_19:
  RtlFreeAnsiString(&DestinationString);
  if( v10 )
    ExFreePoolWithTag(v10, 0);
  if( KeyHandle )
    ZwClose(KeyHandle);
  return v9;
}

Referenced by: