BiGetNtPartitionPath

VOID __fastcall BiGetNtPartitionPath(INT64 a1, __m256i *a2, INT64 *a3, INT64 a4){
  WCHAR *v4; 
  wchar_t *Buffer; 
  int v6; 
  wchar_t *v7; 
  WCHAR *PoolWithTag; 
  WCHAR v9; 
  unsigned int v10; 
  wchar_t *v11; 
  char v12; 
  NTSTATUS v13; 
  int v14; 
  WCHAR **v15; 
  bool v16; 
  unsigned __int64 v17; 
  _DWORD *v18; 
  int v19; 
  _QWORD *v20; 
  __int64 v21; 
  __int64 v22; 
  bool v23; 
  WCHAR v24; 
  WCHAR *PartitionVhdFilePath; 
  __int64 v26; 
  WCHAR *v27; 
  bool v28; 
  int v29; 
  WCHAR **v30; 
  UINT64 Context; 
  _QWORD *v32; 
  wchar_t *Str1; 
  int v34; 
  __int64 v35; 
  PVOID P; 
  _QWORD *v37; 
  void *DirectoryHandle; 
  UNICODE_STRING FileHandle; 
  WCHAR *ResultName; 
  __m256i *v41; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING v43; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _OBJECT_ATTRIBUTES v45; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  INT64 v47[5]; 
  v41 = a2;
  v37 = 0i64;
  *(_QWORD *)&FileHandle.Length = 0i64;
  DirectoryHandle = 0i64;
  LODWORD(Context) = 0;
  memset(v47, 0, sizeof(v47));
  P = 0i64;
  v4 = 0i64;
  v32 = 0i64;
  Buffer = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v35 = 0i64;
  ResultName = 0i64;
  Str1 = 0i64;
  DestinationString = 0i64;
  memset(&v45, 0, sizeof(v45));
  IoStatusBlock = 0i64;
  v43 = 0i64;
  v6 = BiVerifyBootPartition((int *)a1, (__int64)&v32, (__int64)&v37, &v35, &Str1, 0i64);
  v7 = Str1;
  if( v6 >= 0 )
  {
    PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x58ui64, 0x4B444342ui64);
    if( !PoolWithTag )
      return;
    v28 = 0;
    if( v7 && !v32 )
      v28 = v37 == 0i64;
    RtlInitUnicodeString(&DestinationString, L"\\Device", v9);
    ObjectAttributes.Length = 48;
    ObjectAttributes.ObjectName = &DestinationString;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( ZwOpenDirectoryObject(&DirectoryHandle, 1ui64, &ObjectAttributes) < 0 )
      goto LABEL_79;
    v10 = 4096;
    v11 = (wchar_t *)ExAllocatePoolWithTag(PagedPool, 0x1000ui64, 0x4B444342ui64);
    v12 = 0;
    while( 1 )
    {
      FileHandle.Buffer = v11;
      Buffer = v11;
      if( !v11 )
        goto LABEL_79;
      LODWORD(Context) = 0;
      v13 = ZwQueryDirectoryObject(DirectoryHandle, v11, v10, 0, 1u, &Context, 0i64);
      v14 = v13;
      if( v13 != 261 )
        break;
      ExFreePoolWithTag(Buffer, 0x4B444342u);
      v10 += 4096;
      v11 = (wchar_t *)ExAllocatePoolWithTag(PagedPool, v10, 0x4B444342ui64);
    }
    if( (int)(v13 + 0x80000000) >= 0 && v13 != -2147483622 )
      goto LABEL_39;
    if( !*Buffer )
      goto LABEL_79;
    v15 = (WCHAR **)(Buffer + 4);
    v16 = v28;
    v30 = v15;
    while( 1 )
    {
      if( !BiIsValidDiskDevice(*v15, v15[2]) )
        goto LABEL_14;
      swprintf_s(PoolWithTag, 0x2Cui64, (WCHAR *)L"\\Device\\%s\\Partition%lu");
      if( (int)BiGetDriveLayoutBlock(PoolWithTag, (DRIVE_LAYOUT_INFORMATION_EX **)&P, (INT64)v47) < 0 )
        goto LABEL_14;
      if( !v7 )
      {
        v17 = *(_QWORD *)(v35 + 4) - *(INT64 *)((char *)v47 + 4);
        if( !v17 )
        {
          v17 = *(_QWORD *)(v35 + 12) - *(INT64 *)((char *)&v47[1] + 4);
          if( !v17 )
            v17 = *(unsigned int *)(v35 + 20) - (unsigned __int64)HIDWORD(v47[2]);
        }
        if( v17 )
        {
          ExFreePoolWithTag(P, 0x4B444342u);
          goto LABEL_14;
        }
      }
      v18 = P;
      v19 = *(_DWORD *)(v35 + 4);
      v34 = v19;
      if( v37 )
      {
        if( v19 == 1 )
        {
          swprintf_s(PoolWithTag, 0x2Cui64, (WCHAR *)L"\\Device\\%s\\Partition%lu");
          RtlInitUnicodeString(&v43, PoolWithTag, v24);
          v45.ObjectName = &v43;
          v45.Length = 48;
          v45.RootDirectory = 0i64;
          v45.Attributes = 576;
          *(_OWORD *)&v45.SecurityDescriptor = 0i64;
          if( ZwOpenFile(&FileHandle, (PWCHAR)0x80000000i64) >= 0 )
          {
            ZwClose(*(HANDLE *)&FileHandle.Length);
            v12 = 1;
          }
          goto LABEL_34;
        }
      }
      else if( v19 == 1 )
      {
        goto LABEL_24;
      }
      if( !v19 )
      {
LABEL_24:
        v20 = 0i64;
        if( !v19 )
        {
          if( v37 )
          {
            v20 = v37;
          }
          else if( v32 )
          {
            v20 = v32;
          }
        }
        v21 = 0i64;
        v29 = 0;
        if( *((_DWORD *)P + 1) )
        {
          do
          {
            v22 = 36 * v21;
            if( v18[36 * v21 + 18] )
            {
              swprintf_s(PoolWithTag, 0x2Cui64, (WCHAR *)L"\\Device\\%s\\Partition%lu");
              if( v16 )
              {
                PartitionVhdFilePath = BiGetPartitionVhdFilePath(PoolWithTag);
                v4 = PartitionVhdFilePath;
                if( PartitionVhdFilePath )
                {
                  if( !wcsicmp(Str1, PartitionVhdFilePath) )
                  {
LABEL_32:
                    v12 = 1;
                    break;
                  }
                  ExFreePoolWithTag(v4, 0x4B444342u);
                  v4 = 0i64;
                }
              }
              if( v34 == 1 )
              {
                if( !v32 )
                  goto LABEL_70;
                v23 = *v32 == *(_QWORD *)&v18[v22 + 14];
              }
              else
              {
                if( !v20 )
                  goto LABEL_70;
                v26 = *v20 - *(_QWORD *)&v18[v22 + 24];
                if( *v20 == *(_QWORD *)&v18[v22 + 24] )
                  v26 = v20[1] - *(_QWORD *)&v18[v22 + 26];
                v23 = v26 == 0;
              }
              if( v23 )
                goto LABEL_32;
            }
LABEL_70:
            v21 = (unsigned int)(v29 + 1);
            v29 = v21;
          }
          while( (unsigned int)v21 < v18[1] );
        }
        v15 = v30;
      }
LABEL_34:
      ExFreePoolWithTag(v18, 0x4B444342u);
      v7 = Str1;
      if( !Str1 )
        goto LABEL_35;
      if( v12 )
      {
        if( v16 )
          goto LABEL_35;
        v27 = BiGetPartitionVhdFilePath(PoolWithTag);
        v4 = v27;
        if( v27 )
        {
          if( !wcsicmp(v7, v27) )
          {
LABEL_35:
            Buffer = FileHandle.Buffer;
            if( !v12 )
              goto LABEL_79;
            if( (int)BiTranslateSymbolicLink(PoolWithTag, &ResultName) >= 0 )
            {
              ExFreePoolWithTag(PoolWithTag, 0x4B444342u);
              PoolWithTag = ResultName;
            }
            v14 = 0;
            v41->m256i_i64[0] = (__int64)PoolWithTag;
LABEL_39:
            if( v14 >= 0 )
            {
LABEL_40:
              if( Buffer )
                ExFreePoolWithTag(Buffer, 0x4B444342u);
              break;
            }
LABEL_79:
            if( PoolWithTag )
              ExFreePoolWithTag(PoolWithTag, 0x4B444342u);
            goto LABEL_40;
          }
          ExFreePoolWithTag(v4, 0x4B444342u);
          v4 = 0i64;
        }
        v12 = 0;
      }
LABEL_14:
      v15 += 4;
      v30 = v15;
      if( !*((_WORD *)v15 - 4) )
        goto LABEL_35;
    }
  }
  if( v7 )
    ExFreePoolWithTag(v7, 0x4B444342u);
  if( v4 )
    ExFreePoolWithTag(v4, 0x4B444342u);
}

Referenced by: