ExpGetDeviceDataInformation

NTSTATUS __stdcall ExpGetDeviceDataInformation(
        _SYSTEM_INFORMATION_CLASS SystemInformationClass,
        VOID *SystemInformation,
        UINT64 SystemInformationLength,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  VOID *DataBuffer; 
  int v11; 
  unsigned int v12; 
  NTSTATUS DeviceData; 
  size_t v14; 
  _UNICODE_STRING SourceString; 
  _UNICODE_STRING v17; 
  UINT64 Length[2]; 
  WCHAR *CapturedString; 
  PWCHAR DataName; 

  SourceString = 0i64;
  v17 = 0i64;
  *(_OWORD *)Length = 0i64;
  CapturedString = 0i64;
  DataName = 0i64;
  DataBuffer = 0i64;
  if( !SystemInformation || (_DWORD)SystemInformationLength != 48 )
    return -1073741820;
  if( ((unsigned __int8)SystemInformation & 3) != 0 )
    ExRaiseDatatypeMisalignment();
  if( (unsigned __int64)SystemInformation + 48 > 0x7FFFFFFF0000i64
    || (char *)SystemInformation + 48 < SystemInformation )
  {
    MEMORY[0x7FFFFFFF0000] = 0;
  }
  SourceString = *(_UNICODE_STRING *)SystemInformation;
  v17 = (_UNICODE_STRING)*((_OWORD *)SystemInformation + 1);
  *(_OWORD *)Length = *((_OWORD *)SystemInformation + 2);
  v11 = ExpStringCapture(&CapturedString, &SourceString);
  if( v11 >= 0 )
  {
    if( SystemInformationClass != SystemDeviceDataInformation || (v11 = ExpStringCapture(&DataName, &v17), v11 >= 0) )
    {
      if( HIDWORD(Length[0]) )
      {
        if( !Length[1] )
        {
          v11 = -1073741811;
          goto LABEL_21;
        }
        v12 = HIDWORD(Length[0]);
        ProbeForWrite(Length[1], HIDWORD(Length[0]), 2i64);
        DataBuffer = ExAllocatePoolWithQuotaTag((POOL_TYPE)9, v12, 0x4E494444ui64);
        if( !DataBuffer )
        {
          v11 = -1073741801;
          goto LABEL_21;
        }
      }
      if( SystemInformationClass == SystemDeviceDataInformation )
        DeviceData = KseQueryDeviceData(CapturedString, DataName, Length, (UINT64 *)((char *)Length + 4), DataBuffer);
      else
        DeviceData = KseQueryDeviceDataList(
                       CapturedString,
                       (WCHAR *)DataBuffer,
                       HIDWORD(Length[0]),
                       (UINT64 *)((char *)Length + 4));
      v11 = DeviceData;
      v14 = HIDWORD(Length[0]);
      *((_QWORD *)SystemInformation + 4) = Length[0];
      if( DeviceData >= 0 )
        memmove((VOID *)Length[1], DataBuffer, v14);
    }
  }
LABEL_21:
  if( CapturedString )
    ExFreePoolWithTag(CapturedString, 0x50535845u);
  if( DataName )
    ExFreePoolWithTag(DataName, 0x50535845u);
  if( DataBuffer )
    ExFreePoolWithTag(DataBuffer, 0x4E494444u);
  return v11;
}

Referenced by: