PiCMGetRelatedDeviceInstance

NTSTATUS __stdcall PiCMGetRelatedDeviceInstance(
        PVOID IoctlInputBuffer,
        UINT64 IoctlInputBufferSize,
        PVOID IoctlOutputBuffer,
        UINT64 IoctlOutputBufferSize,
        UINT64 *BytesUsed){
  unsigned int v5; 
  VOID *v6; 
  wchar_t *PoolWithTag; 
  unsigned int v8; 
  WCHAR *v9; 
  __int64 v10; 
  NTSTATUS inited; 
  unsigned int v12; 
  unsigned int v13; 
  unsigned int v14; 
  NTSTATUS DeviceParent; 
  NTSTATUS v16; 
  WCHAR *v18; 
  UINT64 BufferSize; 
  UINT64 dwFlags; 
  UINT64 IoctlOutputBufferSizea; 
  UINT64 RelatedDeviceInstanceLength; 
  struct _UNICODE_STRING DestinationString; 
  INT64 v24[2]; 
  PCWSTR SourceString[2]; 
  UINT64 ExpectedOutputSize; 
  unsigned int v28; 
  UINT64 *v29; 
  v28 = IoctlOutputBufferSize;
  ExpectedOutputSize = 0i64;
  v5 = IoctlOutputBufferSize;
  v6 = IoctlOutputBuffer;
  PoolWithTag = 0i64;
  v8 = 0;
  *(_OWORD *)v24 = 0i64;
  *(_DWORD *)v29 = 0;
  v9 = 0i64;
  *(_OWORD *)SourceString = 0i64;
  DestinationString = 0i64;
  inited = PiCMCaptureObjectInputData(
             (UINT64)IoctlInputBuffer,
             IoctlInputBufferSize,
             (unsigned int)BytesUsed,
             (INT64)v24);
  if( inited < 0 )
    goto LABEL_22;
  if( SourceString[0] && *(INT64 *)((char *)v24 + 4) == 0x100000000i64 )
  {
    if( v6 && v5 >= 0x14 )
    {
      v12 = v5 - 20;
      v13 = 0;
      v14 = 2;
      if( v12 >= 2 )
        v13 = v12;
      if( v13 )
      {
        PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v13, 0x34706E50ui64);
        if( !PoolWithTag )
          inited = -1073741670;
      }
      if( inited < 0 )
        goto LABEL_34;
      inited = CmValidateDeviceName(v10, SourceString[0]);
      if( inited < 0 )
        goto LABEL_34;
      switch( HIDWORD(SourceString[1]) )
      {
        case 1:
          LODWORD(RelatedDeviceInstanceLength) = v13 >> 1;
          DeviceParent = CmGetDeviceParent(
                           PiPnpRtlCtx,
                           SourceString[0],
                           PoolWithTag,
                           (ULONG *)&RelatedDeviceInstanceLength);
          v8 = RelatedDeviceInstanceLength;
          inited = DeviceParent;
LABEL_15:
          v5 = v28;
          v6 = IoctlOutputBuffer;
          goto LABEL_16;
        case 2:
LABEL_24:
          inited = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)SourceString[0]);
          if( inited < 0 )
            goto LABEL_34;
          LODWORD(RelatedDeviceInstanceLength) = 400;
          v18 = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x190ui64, 0x34706E50ui64);
          v9 = v18;
          if( !v18 )
          {
            inited = -1073741670;
            goto LABEL_34;
          }
          inited = PiGetRelatedDevice(&DestinationString, v18, &RelatedDeviceInstanceLength, v14);
          if( inited < 0 )
          {
LABEL_34:
            LODWORD(IoctlOutputBufferSizea) = v28;
            LODWORD(dwFlags) = ExpectedOutputSize;
            LODWORD(BufferSize) = 0;
            v16 = PiCMReturnBufferResultData(
                    (unsigned int)inited,
                    2 * v8,
                    0i64,
                    0i64,
                    BufferSize,
                    dwFlags,
                    IoctlOutputBuffer,
                    IoctlOutputBufferSizea,
                    v29);
            goto LABEL_18;
          }
          LODWORD(dwFlags) = 2048;
          inited = RtlStringCbCopyExW(PoolWithTag, v13, v9, 0i64, 0i64, dwFlags);
          if( inited == -2147483643 )
            inited = -1073741789;
          v8 = ((unsigned int)RelatedDeviceInstanceLength >> 1) + 1;
          goto LABEL_15;
        case 3:
          if( CmIsRootDevice(SourceString[0]) )
          {
            inited = -1073741810;
            goto LABEL_34;
          }
          v14 = 3;
          goto LABEL_24;
      }
    }
    inited = -1073741811;
    goto LABEL_34;
  }
  inited = -1073741811;
LABEL_16:
  if( inited < 0 )
    goto LABEL_34;
  LODWORD(IoctlOutputBufferSizea) = v5;
  LODWORD(dwFlags) = ExpectedOutputSize;
  LODWORD(BufferSize) = 2 * v8;
  v16 = PiCMReturnBufferResultData(
          (unsigned int)inited,
          2 * v8,
          0i64,
          (UINT8 *)PoolWithTag,
          BufferSize,
          dwFlags,
          v6,
          IoctlOutputBufferSizea,
          v29);
LABEL_18:
  inited = v16;
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x34706E50u);
  if( v9 )
    ExFreePoolWithTag(v9, 0x34706E50u);
LABEL_22:
  PiCMReleaseObjectInputData((INT64)v24);
  return inited;
}

Referenced by: