NtEnumerateBootEntries
NTSTATUS __stdcall NtEnumerateBootEntries(VOID *Buffer, UINT64 *BufferLength){
NTSTATUS result;
INT8 PreviousMode;
__int64 v5;
unsigned int v6;
__int64 v7;
NTSTATUS v8;
_DWORD *v9;
_ETHREAD *v10;
VOID **PoolWithTag;
VOID **v12;
unsigned int v13;
unsigned int v14;
NTSTATUS v15;
VOID **v16;
char *v17;
__int64 v18;
int v19;
unsigned int v20;
unsigned int v21;
__int64 v22;
__int64 v23;
unsigned int v24;
unsigned int v25;
char *v26;
size_t v27;
unsigned __int64 v28;
unsigned int v29;
int v30;
_BOOL4 v31;
NTSTATUS v32;
size_t v33;
int v34;
_BOOL4 v35;
_BOOL4 v36;
unsigned int v37;
unsigned int v38;
__int64 v39;
WCHAR *v40;
int v41;
int v42;
int v43;
__int64 v44;
_BYTE *v45;
__int64 v46;
VOID **LockedBuffer;
UINT64 NumberOfBytes;
int v49;
_BOOL4 v50;
unsigned int v51;
int v52;
_DWORD *v53;
UINT64 Id;
unsigned int v55;
char *v56;
unsigned int v57;
size_t v58;
_FILE_PATH *FilePath;
VOID *LockVariable;
WCHAR *v61;
VOID *Src;
size_t Size[2];
VOID *v64;
size_t v65[2];
VOID *v66;
_ETHREAD *CurrentThread;
char v69;
FilePath = 0i64;
LockVariable = 0i64;
if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
return -1073741822;
if( (VOID *)((unsigned __int64)Buffer & 0xFFFFFFFFFFFFFFFCui64) != Buffer )
return -1073741811;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = CurrentThread->Tcb.PreviousMode;
BYTE4(NumberOfBytes) = PreviousMode;
if( PreviousMode )
{
v5 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)BufferLength < 0x7FFFFFFF0000i64 )
v5 = (__int64)BufferLength;
*(_DWORD *)v5 = *(_DWORD *)v5;
v6 = Buffer != 0i64 ? *(_DWORD *)BufferLength : 0;
v51 = v6;
if( v6 )
ProbeForWrite((UINT64)Buffer, v6, 4i64);
PreviousMode = BYTE4(NumberOfBytes);
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, SBYTE4(NumberOfBytes)) )
return -1073741727;
}
else
{
v6 = Buffer != 0i64 ? *(_DWORD *)BufferLength : 0;
v51 = v6;
}
if( !v6
|| (result = ExLockUserBuffer(Buffer, v6, PreviousMode, IoWriteAccess, (VOID **)&FilePath, &LockVariable),
result >= 0) )
{
v7 = (__int64)FilePath;
v50 = v6 != 0;
v8 = 0;
v49 = 0;
v9 = 0i64;
v53 = 0i64;
v10 = (_ETHREAD *)KeGetCurrentThread();
--v10->Tcb.KernelApcDisable;
ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x2000ui64, 1920364101i64);
v12 = PoolWithTag;
v13 = PoolWithTag != 0i64 ? 0x2000 : 0;
LODWORD(NumberOfBytes) = v13;
while( 1 )
{
v15 = IoEnumerateEnvironmentVariablesEx(
(WCHAR *)2,
(_GUID *)ExpIsBootEntry,
PoolWithTag,
&NumberOfBytes,
(UINT64 *)LockedBuffer);
if( v15 != -1073741789 )
break;
v14 = NumberOfBytes;
if( v13 >= (unsigned int)NumberOfBytes )
break;
if( v12 )
{
ExFreePoolWithTag(v12, 0);
v14 = NumberOfBytes;
}
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v14, 1920364101i64);
v12 = PoolWithTag;
if( !PoolWithTag )
{
v15 = -1073741670;
break;
}
v13 = NumberOfBytes;
}
ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
KeLeaveCriticalRegion();
if( !v15 && (_DWORD)NumberOfBytes )
{
v16 = v12;
v17 = (char *)v12 + 2 * (unsigned int)NumberOfBytes;
v56 = v17;
while( 1 )
{
LODWORD(Id) = 0;
v18 = (__int64)v16[2] - *(_QWORD *)&EfiBootVariablesGuid.Data1;
if( !v18 )
v18 = (__int64)v16[3] - *(_QWORD *)EfiBootVariablesGuid.Data4;
if( !v18 )
{
ExpTranslateBootEntryNameToId((WCHAR *)v16 + 16, &Id);
if( v19 )
{
v20 = *((_DWORD *)v16 + 2);
if( v20 < 8 )
goto LABEL_71;
v61 = (WCHAR *)((char *)v16 + *((unsigned int *)v16 + 1));
v64 = v61 + 3;
v21 = ExpSafeWcslen(v61 + 3, v17);
v24 = v21;
if( v21 != -1 )
v24 = 2 * v21 + 2;
v25 = v23 + v24 + 6;
if( v24 == -1 || (unsigned int)v23 >= v20 || v20 < v25 )
{
v17 = v56;
LABEL_71:
v9 = v53;
goto LABEL_72;
}
v69 = 1;
*(_QWORD *)Size = v24;
v26 = (char *)(v24 + v22 + 6);
v66 = v26;
*(_QWORD *)v65 = v23;
Src = &v26[v23];
v27 = v20 - v25;
v28 = (v7 + 3) & 0xFFFFFFFFFFFFFFFCui64;
if( v28 != v7 )
{
v29 = v28 - v7;
v7 = (v7 + 3) & 0xFFFFFFFFFFFFFFFCui64;
if( v6 >= v29 )
{
v6 -= v29;
}
else
{
v50 = 0;
v6 = 0;
v49 = -1073741789;
}
}
v30 = v23 + 12;
v52 = v23 + 12;
if( v6 >= (int)v23 + 12 )
{
*(_DWORD *)v7 = 1;
*(_DWORD *)(v7 + 4) = v30;
*(_DWORD *)(v7 + 8) = 4;
memmove((VOID *)(v7 + 12), v26, v23);
v32 = ExpVerifyFilePath((_FILE_PATH *)v7, (VOID *)(v7 + *(unsigned int *)(v7 + 4)));
v31 = v50;
if( v32 >= 0 )
{
v30 = v52;
}
else
{
v69 = 0;
v30 = 16;
v52 = 16;
}
}
else
{
v6 = 0;
v31 = 0;
v49 = -1073741789;
}
HIDWORD(Id) = (v27 + 31) & 0xFFFFFFFC;
v55 = (v24 + HIDWORD(Id) + 3) & 0xFFFFFFFC;
v57 = v30 + v55;
v33 = v30 + v55 + 4;
v58 = v33;
v34 = v49;
if( v6 < v33 )
v34 = -1073741789;
v49 = v34;
v35 = 0;
if( v6 >= v33 )
v35 = v31;
v36 = v35;
v50 = v35;
v37 = v6;
v38 = v6 - v33;
v6 = 0;
if( v37 >= v33 )
v6 = v38;
if( v36 )
{
v39 = v7 + 4;
memset((VOID *)v7, 0i64, v33);
*(_DWORD *)(v7 + 4) = 1;
*(_DWORD *)(v7 + 8) = v57;
*(_DWORD *)(v7 + 12) = Id;
*(_DWORD *)(v7 + 16) = 0;
v40 = v61;
v41 = *(_DWORD *)v61;
v42 = 0;
if( (*(_DWORD *)v61 & 1) != 0 )
{
*(_DWORD *)(v7 + 16) = 1;
v41 = *(_DWORD *)v40;
v42 = 1;
}
if( (v41 & 8) != 0 )
*(_DWORD *)(v7 + 16) = v42 | 0x10;
*(_DWORD *)(v7 + 20) = HIDWORD(Id);
*(_DWORD *)(v7 + 24) = v55;
*(_DWORD *)(v7 + 28) = v27;
memmove((VOID *)(v7 + 32), Src, v27);
if( v27 > 0x14 )
{
strcmp((UINT8 *)(v7 + 32), (UINT8 *)"WINDOWS");
if( !v43 && ExpVerifyWindowsOsOptions(v7 + 32, v27) >= 0 )
*(_DWORD *)(v7 + 16) |= 4u;
}
memmove((VOID *)(v39 + HIDWORD(Id)), v64, Size[0]);
v44 = v39 + v55;
*(_DWORD *)v44 = 1;
*(_DWORD *)(v44 + 4) = v52;
*(_DWORD *)(v44 + 8) = 4;
v45 = (_BYTE *)(v44 + 12);
if( v69 )
{
memmove(v45, v66, v65[0]);
if( ExpIsDevicePathForRemovableMedia(v66) )
*(_DWORD *)(v7 + 16) |= 8u;
}
else
{
*(_DWORD *)(v7 + 16) |= 0x20u;
*v45 = 127;
*(_WORD *)(v44 + 13) = 1279;
*(_BYTE *)(v44 + 15) = 0;
}
if( v53 )
*v53 = v7 - (_DWORD)v53;
v9 = (_DWORD *)v7;
v53 = (_DWORD *)v7;
v33 = v58;
}
else
{
v9 = v53;
}
v7 += v33;
v17 = v56;
}
}
LABEL_72:
v46 = *(unsigned int *)v16;
if( !(_DWORD)v46 )
{
v8 = v49;
if( v9 )
*v9 = 0;
goto LABEL_78;
}
v16 = (VOID **)((char *)v16 + v46);
}
}
if( v15 == -1073741789 )
v15 = -1073741306;
LABEL_78:
if( v12 )
ExFreePoolWithTag(v12, 0);
if( LockVariable )
ExUnlockUserBuffer(LockVariable);
if( v15 < 0 )
v8 = v15;
*(_DWORD *)BufferLength = v7 - (_DWORD)FilePath;
return v8;
}
return result;
}Referenced by:
No references.