PnpLoadBootFilterDriver

__int64 __fastcall PnpLoadBootFilterDriver(
        PVOID KeyHandle,
        _UNICODE_STRING *String1,
        unsigned int a3,
        _LIST_ENTRY **a4){
  __int64 **v5; 
  _HANDLE v7; 
  unsigned int i; 
  __int64 *j; 
  __int64 v10; 
  __int64 v11; 
  __int64 *v12; 
  int started; 
  _LIST_ENTRY *v14; 
  int v15; 
  int v17; 
  _UNICODE_STRING DriverName; 
  PVOID Object; 

  Object = 0i64;
  *a4 = 0i64;
  v5 = (__int64 **)*(&stru_140C452E0 + 63);
  v7 = (int)KeyHandle;
  DriverName = 0i64;
  if( !*(&stru_140C452E0 + 63) || a3 >= *(&stru_140C452E0 + 122) )
    return 3221225473i64;
  for( i = 0; i < a3; v5 += 2 )
  {
    for( j = *v5; j != (__int64 *)(*(&stru_140C452E0 + 63) + 16i64 * i); j = (__int64 *)*j )
    {
      if( !*((_BYTE *)j + 47) )
        return 3221225473i64;
    }
    ++i;
  }
  _mm_lfence();
  v10 = 16i64 * a3;
  v11 = v10 + *(&stru_140C452E0 + 63);
  v12 = *(__int64 **)(v10 + *(&stru_140C452E0 + 63));
  while( v12 != (__int64 *)v11 )
  {
    if( IopGetDriverNameFromKeyNode((PVOID)v12[4], &DriverName) >= 0 )
    {
      if( (unsigned __int8)RtlEqualUnicodeString(String1, &DriverName, 1u) )
      {
        if( *((_BYTE *)v12 + 47) )
        {
          v15 = *((_DWORD *)v12 + 10);
          if( v15 >= 0 )
            v15 = -1073741823;
        }
        else
        {
          started = PnpInitializeBootStartDriver(
                      &DriverName,
                      v12[3] + 32,
                      *(_QWORD *)(*(_QWORD *)(v12[3] + 48) + 56i64),
                      *(_QWORD *)(v12[3] + 48),
                      &KeLoaderBlock_0->LoadOrderListHead,
                      1,
                      1,
                      v17,
                      (INT64)&Object);
          v14 = (_LIST_ENTRY *)Object;
          v15 = started;
          *((_DWORD *)v12 + 10) = started;
          v12[2] = (__int64)v14;
          *((_BYTE *)v12 + 47) = 1;
          if( v14 )
          {
            ObfReferenceObjectWithTag(v14, 0x746C6644ui64);
            *a4 = v14;
          }
          else
          {
            *((_BYTE *)v12 + 46) = 1;
          }
        }
        ExFreePoolWithTag(DriverName.Buffer, 0);
        return(unsigned int)v15;
      }
      ExFreePoolWithTag(DriverName.Buffer, 0);
    }
    v12 = (__int64 *)*v12;
    v11 = v10 + *(&stru_140C452E0 + 63);
  }
  v15 = -1073741823;
  if( PipIs32bitKey(v7) )
    return(unsigned int)-1073740948;
  return(unsigned int)v15;
}

Referenced by: