RamdiskStart

NTSTATUS __stdcall RamdiskStart(_LOADER_PARAMETER_BLOCK *LoaderBlock){
  _LIST_ENTRY *v2; 
  _LIST_ENTRY *p_MemoryDescriptorListHead; 
  _LIST_ENTRY *Flink; 
  NTSTATUS Status; 
  __int64 v6; 
  _LIST_ENTRY *v7; 
  char *LoadOptions; 
  CHAR v9; 
  UINT8 *v10; 
  CHAR v11; 
  __int64 v12; 
  unsigned int v13; 
  UINT8 *v14; 
  CHAR v15; 
  __int64 v16; 
  CHAR v17; 
  _UNICODE_STRING *v18; 
  __int64 v19; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  VOID *FileHandle; 
  __int128 v24; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _UNICODE_STRING GuidString; 
  _UNICODE_STRING SymbolicLinkName; 
  _STRING DestinationString; 
  _UNICODE_STRING DeviceName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 InputBuffer[8]; 
  INT8 pszDest[32]; 
  WCHAR SourceString[56]; 

  GuidString = 0i64;
  v2 = 0i64;
  DestinationString = 0i64;
  SymbolicLinkName = 0i64;
  DeviceName = 0i64;
  v24 = 0i64;
  memset(InputBuffer, 0i64, sizeof(InputBuffer));
  FileHandle = 0i64;
  p_MemoryDescriptorListHead = &LoaderBlock->MemoryDescriptorListHead;
  Flink = LoaderBlock->MemoryDescriptorListHead.Flink;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  IoStatusBlock = 0i64;
  while( Flink != p_MemoryDescriptorListHead )
  {
    v2 = Flink;
    if( LODWORD(Flink[1].Flink) == 25 )
      break;
    Flink = Flink->Flink;
  }
  if( Flink == p_MemoryDescriptorListHead )
  {
    Status = -1073741811;
    v6 = 1i64;
    goto LABEL_28;
  }
  InputBuffer[3] = 0i64;
  v6 = 3i64;
  HIDWORD(InputBuffer[2]) = 3;
  *(_DWORD *)((char *)&InputBuffer[7] + 2) = 0;
  HIWORD(InputBuffer[7]) = 0;
  LODWORD(InputBuffer[0]) = 64;
  InputBuffer[6] = (__int64)v2[1].Blink;
  LOWORD(InputBuffer[7]) = 0;
  InputBuffer[5] = 0i64;
  InputBuffer[3] = 2i64;
  *(_GUID *)((char *)InputBuffer + 4) = RamdiskBootDiskGuid;
  v7 = v2[2].Flink;
  LoadOptions = LoaderBlock->LoadOptions;
  InputBuffer[4] = (_QWORD)v7 << 12;
  if( LoadOptions )
  {
    strupr(LoadOptions);
    strstr((UINT8 *)LoadOptions, (UINT8 *)"RDIMAGEOFFSET", v9);
    if( v10 && (strstr(v10, (UINT8 *)"=", v11), v12) )
    {
      v13 = atol((const CHAR *)(v12 + 1));
      LODWORD(InputBuffer[5]) = v13;
    }
    else
    {
      v13 = InputBuffer[5];
    }
    InputBuffer[4] -= v13;
    strstr((UINT8 *)LoadOptions, (UINT8 *)"RDIMAGELENGTH", v11);
    if( v14 )
    {
      strstr(v14, (UINT8 *)"=", v15);
      if( v16 )
        InputBuffer[4] = atoi64((const char *)(v16 + 1));
    }
  }
  LODWORD(v24) = 2097182;
  *((_QWORD *)&v24 + 1) = L"\\Device\\Ramdisk";
  LODWORD(OpenOptions) = 32;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v24;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  LODWORD(ShareAccess) = 3;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  Status = ZwOpenFile(&FileHandle, 0xC0000000ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
  if( Status < 0 || (Status = IoStatusBlock.Status, IoStatusBlock.Status < 0) )
  {
    v6 = 2i64;
    goto LABEL_28;
  }
  Status = ZwDeviceIoControlFile(
             (_HANDLE)FileHandle,
             0,
             0i64,
             0i64,
             &IoStatusBlock,
             0x240000u,
             InputBuffer,
             0x40u,
             0i64,
             0);
  ZwClose((_HANDLE)FileHandle);
  if( Status < 0 || (Status = IoStatusBlock.Status, IoStatusBlock.Status < 0) )
LABEL_28:
    KeBugCheckEx(0xF8u, (PVOID)v6, (PVOID)Status, 0i64, 0i64);
  strstr((UINT8 *)LoaderBlock->ArcBootDeviceName, (UINT8 *)"vdisk(", v17);
  if( !v19 )
  {
    Status = RtlStringFromGUID((_GUID *)((char *)InputBuffer + 4), &GuidString, v18);
    if( Status < 0 )
    {
      v6 = 4i64;
      goto LABEL_28;
    }
    RtlStringCbPrintfA(pszDest, 0x14ui64, (INT8 *)"\\ArcName\\%s");
    RtlInitAnsiString(&DestinationString, pszDest);
    Status = RtlAnsiStringToUnicodeString(&SymbolicLinkName, &DestinationString, 1u);
    if( Status < 0 )
    {
      v6 = 5i64;
      goto LABEL_28;
    }
    RtlStringCbPrintfW(SourceString, 0x6Cui64, (WCHAR *)L"\\Device\\Ramdisk%wZ");
    RtlInitUnicodeString(&DeviceName, SourceString);
    Status = IoCreateSymbolicLink(&SymbolicLinkName, &DeviceName);
    RtlFreeAnsiString(&GuidString);
    RtlFreeAnsiString(&SymbolicLinkName);
    if( Status < 0 )
    {
      v6 = 6i64;
      goto LABEL_28;
    }
  }
  return 0;
}

Referenced by: