PopBootStatGet

NTSTATUS __stdcall PopBootStatGet(INT64 a1, INT64 a2){
  VOID **PoolWithTag; 
  char PreviousMode; 
  NTSTATUS SetBootStatusData; 
  UINT64 v6; 
  UINT64 v7; 
  __int64 i; 
  _ETHREAD *CurrentThread; 
  void *v10; 
  UINT64 v11; 
  __int64 j; 
  __int64 v13; 
  UINT64 DataBufferLength; 
  UINT64 *BytesReturned; 
  UINT64 v17; 
  unsigned int v18; 
  VOID *BootStatusDataHandle; 
  int v20; 
  _RTL_BSD_ITEM_TYPE DataItem; 
  PVOID P; 
  UINT64 pullResult; 
  VOID **v24; 
  VOID *Src; 
  char v28; 

  pullResult = 0i64;
  LODWORD(v17) = 0;
  v18 = 0;
  v20 = 0;
  PoolWithTag = 0i64;
  BootStatusDataHandle = 0i64;
  v28 = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    SetBootStatusData = RtlULongLongMult(*(unsigned int *)(a1 + 8), 0x18ui64, &pullResult);
    if( SetBootStatusData < 0 )
      goto LABEL_25;
    v6 = pullResult;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, pullResult, 544040269i64);
    P = PoolWithTag;
    if( !PoolWithTag )
    {
      SetBootStatusData = -1073741670;
      goto LABEL_25;
    }
    if( v6 )
    {
      v7 = *(_QWORD *)(a1 + 16);
      if( (v7 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v7 + v6 > 0x7FFFFFFF0000i64 || v7 + v6 < v7 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    memmove(PoolWithTag, *(const VOID **)(a1 + 16), v6);
    for( i = 0i64; ; i = (unsigned int)(i + 1) )
    {
      HIDWORD(v17) = i;
      if( (unsigned int)i >= *(_DWORD *)(a1 + 8) )
        break;
      v24 = &PoolWithTag[3 * i];
      ProbeForWrite((UINT64)v24[1], *((unsigned int *)v24 + 4), 1i64);
    }
  }
  else
  {
    PoolWithTag = *(VOID ***)(a1 + 16);
    P = PoolWithTag;
  }
  v28 = 1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&PopBootStatLock, 0i64);
  SetBootStatusData = RtlLockBootStatusData(&BootStatusDataHandle);
  if( SetBootStatusData >= 0 )
  {
    if( !PreviousMode
      || (LOBYTE(v10) = PreviousMode,
          SetBootStatusData = PopBootStatAccessCheck(
                                (_DEVICE_NODE *)BootStatusDataHandle,
                                v10,
                                (PWCHAR)1,
                                v11,
                                DataBufferLength,
                                (UINT8 *)BytesReturned),
          SetBootStatusData >= 0) )
    {
      for( j = 0i64; ; j = (unsigned int)(j + 1) )
      {
        HIDWORD(v17) = j;
        if( (unsigned int)j >= *(_DWORD *)(a1 + 8) )
          break;
        v24 = &PoolWithTag[3 * j];
        DataItem = *(_DWORD *)v24;
        SetBootStatusData = RtlBootStatusItemInfo(DataItem, &v18, &v20);
        if( SetBootStatusData < 0 )
          break;
        Src = (char *)&unk_140CED2E0 + v18;
        LODWORD(DataBufferLength) = *(_DWORD *)(v13 + 16);
        SetBootStatusData = RtlGetSetBootStatusData(BootStatusDataHandle, 1u, DataItem, Src, DataBufferLength, &v17);
        if( SetBootStatusData >= 0 && (_DWORD)v17 )
          memmove(v24[1], Src, v17);
        if( a2 )
          *(_DWORD *)(a2 + 4 * j) = v17;
      }
    }
  }
LABEL_25:
  if( BootStatusDataHandle )
    RtlUnlockBootStatusData(BootStatusDataHandle);
  if( v28 )
  {
    if( (_InterlockedExchangeAdd64(&PopBootStatLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&PopBootStatLock);
    KeAbPostRelease(&PopBootStatLock);
    KeLeaveCriticalRegion();
  }
  if( PreviousMode && PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return SetBootStatusData;
}

Referenced by: