IopInitializeBootLogging
VOID __stdcall IopInitializeBootLogging(_LOADER_PARAMETER_BLOCK *LoaderBlock, INT8 *HeaderString){
VOID **Pool_1;
VOID **v5;
INT64 v6;
_LIST_ENTRY *Flink;
__int64 v8;
__int64 v9;
unsigned __int64 v10;
wchar_t *Buffer;
PUNICODE_STRING v12;
unsigned __int16 Length;
unsigned __int16 v14;
INT64 i;
_STRING SourceString;
INT64 v17;
v17 = 0i64;
*(_DWORD *)(&SourceString.MaximumLength + 1) = 0;
if( !qword_140D2C030 )
{
Pool_1 = IopVerifierExAllocatePool_1(0x200ui64, 0xB0ui64);
qword_140D2C030 = (PUNICODE_STRING)Pool_1;
v5 = Pool_1;
if( Pool_1 )
{
memset(Pool_1, 0i64, 0xB0u);
ExInitializeResourceLite((INT64)(v5 + 8));
ExAcquireResourceExclusiveLite((UINT64)&qword_140D2C030[4], 1, v6);
Flink = LoaderBlock->LoadOrderListHead.Flink;
v8 = -1i64;
if( RtlFindMessage(Flink[3].Flink, 0xBui64, 0i64, 0xB5ui64, (UINT16 **)&v17) >= 0 )
{
v9 = -1i64;
SourceString.Buffer = (char *)(v17 + 4);
do
++v9;
while( *(_BYTE *)(v17 + 4 + v9) );
SourceString.Length = v9;
SourceString.MaximumLength = v9 + 1;
RtlAnsiStringToUnicodeString(qword_140D2C030, &SourceString, 1u);
if( qword_140D2C030->Length > 4u )
{
v10 = (unsigned __int16)(qword_140D2C030->Length - 4);
Buffer = qword_140D2C030->Buffer;
qword_140D2C030->Length = v10;
Buffer[v10 >> 1] = 0;
}
}
if( RtlFindMessage(Flink[3].Flink, 0xBui64, 0i64, 0xB6ui64, (UINT16 **)&v17) < 0 )
{
v12 = qword_140D2C030;
}
else
{
SourceString.Buffer = (char *)(v17 + 4);
do
++v8;
while( *(_BYTE *)(v17 + 4 + v8) );
SourceString.Length = v8;
SourceString.MaximumLength = v8 + 1;
RtlAnsiStringToUnicodeString(qword_140D2C030 + 1, &SourceString, 1u);
v12 = qword_140D2C030;
Length = qword_140D2C030[1].Length;
if( Length > 4u )
{
v14 = Length - 4;
qword_140D2C030[1].Length = v14;
v12[1].Buffer[(unsigned __int64)v14 >> 1] = 0;
}
}
RtlCreateUnicodeStringFromAsciiz((INT64)&v12[3], (INT64)(HeaderString + 1));
ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
for( i = PsLoadedModuleList; (INT64 *)i != &PsLoadedModuleList; i = *(_QWORD *)i )
IopBootLog((_UNICODE_STRING *)(i + 72), 1u);
ExReleaseResourceLite(&PsLoadedModuleResource);
ExReleaseResourceLite((PERESOURCE)&qword_140D2C030[4]);
}
}
}Referenced by:
No references.