RtlLockBootStatusData
INT64 __fastcall RtlLockBootStatusData(VOID **BootStatusDataHandle){
wchar_t *Buffer;
NTSTATUS v3;
WCHAR v4;
WCHAR v5;
struct _UNICODE_STRING DestinationString;
struct _IO_STATUS_BLOCK IoStatusBlock;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
CHAR a2;
UNICODE_STRING FileHandle;
*(_QWORD *)&FileHandle.Length = 0i64;
Buffer = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
FileHandle.Buffer = 0i64;
v3 = 0;
a2 = 0;
DestinationString = 0i64;
IoStatusBlock = 0i64;
RtlpAcquireBootStatusLock();
++BootStatReferenceCount;
if( BootStatFileHandleAcquired )
{
if( BootStatusDataHandle )
{
*BootStatusDataHandle = BootStatFileHandle;
goto LABEL_10;
}
goto LABEL_4;
}
RtlpGetBootStatusPath((UINT8 **)&FileHandle.Buffer, &a2, v4);
Buffer = FileHandle.Buffer;
RtlInitUnicodeString(&DestinationString, FileHandle.Buffer, v5);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &DestinationString;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 704;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
v3 = ZwOpenFile(&FileHandle, (PWCHAR)0x12019F);
if( v3 < 0 )
{
BootStatFileHandle = 0i64;
BootStatReferenceCount = 0;
BootStatFileHandleAcquired = 0;
if( BootStatusDataHandle )
*BootStatusDataHandle = 0i64;
}
else
{
BootStatFileHandle = *(HANDLE *)&FileHandle.Length;
BootStatFileHandleAcquired = 1;
RtlInitializeBootStatDataCache();
if( !BootStatusDataHandle )
{
LABEL_4:
BootStatKeepHandleOpen = 1;
goto LABEL_10;
}
*BootStatusDataHandle = *(VOID **)&FileHandle.Length;
}
LABEL_10:
RtlpReleaseBootStatusLock();
if( a2 )
ExFreePoolWithTag(Buffer, 0);
return(unsigned int)v3;
}Referenced by:
CmCompleteRegistryInitialization
PoClearTransitionMarker
PopBootStatCheckIntegrity
PopBootStatGet
PopBootStatRestoreDefaults
PopBootStatSet