ExpSetBootEntry
VOID __stdcall ExpSetBootEntry(){
const VOID *v0;
int v1;
unsigned int *v2;
const VOID *v3;
unsigned int i;
void *v5;
void *v6;
INT8 PreviousMode;
unsigned __int64 v8;
unsigned int v9;
UINT64 v10;
unsigned __int64 v11;
__int64 v12;
VOID **PoolWithTag;
UINT8 *v14;
UINT8 *v15;
int v16;
NTSTATUS EnvironmentVariable;
void *v18;
__int64 v19;
int v20;
_FILE_PATH *v21;
UINT8 *v22;
int v23;
VOID *v24;
int v25;
VOID **v26;
_FILE_PATH *v27;
unsigned int Length;
unsigned int v29;
size_t v30;
size_t v31;
VOID **v32;
size_t v33;
VOID **v34;
int v35;
int v36;
__int64 v37;
char *v38;
char *v39;
_FILE_PATH *v40;
_ETHREAD *v41;
UINT64 *Attributes;
int v43;
UINT64 OutputFilePathLength;
VOID *Value;
_FILE_PATH *InputFilePath;
_FILE_PATH *v47;
UINT64 v48;
int v50;
UINT64 ValueLength;
PVOID P;
unsigned int v53;
unsigned __int64 v54;
VOID *Src;
unsigned int *v56;
_ETHREAD *CurrentThread;
WCHAR Dst[12];
v56 = v2;
v3 = v0;
v43 = v1;
P = 0i64;
i = 0;
v5 = 0i64;
v6 = 0i64;
Value = 0i64;
LODWORD(v48) = 0;
OutputFilePathLength = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = CurrentThread->Tcb.PreviousMode;
v8 = (unsigned __int64)v3 + 4;
if( PreviousMode )
{
if( v8 >= 0x7FFFFFFF0000i64 )
v8 = 0x7FFFFFFF0000i64;
v9 = *(_DWORD *)v8;
v53 = *(_DWORD *)v8;
}
else
{
v9 = *(_DWORD *)v8;
v53 = *(_DWORD *)v8;
}
if( v9 >= 0x1C )
{
if( PreviousMode )
{
if( ((unsigned __int8)v3 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v10 = v9;
v11 = (unsigned __int64)v3 + v9;
if( v11 > 0x7FFFFFFF0000i64 || v11 < (unsigned __int64)v3 )
MEMORY[0x7FFFFFFF0000] = 0;
if( v2 )
{
v12 = (__int64)v2;
if( (unsigned __int64)v2 >= 0x7FFFFFFF0000i64 )
v12 = 0x7FFFFFFF0000i64;
*(_DWORD *)v12 = *(_DWORD *)v12;
v9 = v53;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
return;
}
else
{
v10 = v9;
}
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v10, 1920364101i64);
v14 = (UINT8 *)PoolWithTag;
P = PoolWithTag;
if( !PoolWithTag )
return;
memmove(PoolWithTag, v3, v10);
v15 = &v14[v10];
v16 = v43;
if( *(_DWORD *)v14 != 1
|| !v43 && *((_DWORD *)v14 + 2) > 0xFFFFu
|| (*((_DWORD *)v14 + 3) &= 0x13u, HIDWORD(v48) = *((_DWORD *)v14 + 4), (v48 & 0x100000000i64) != 0)
|| (LODWORD(ValueLength) = *((_DWORD *)v14 + 5), (ValueLength & 3) != 0) )
{
EnvironmentVariable = -1073741811;
v18 = Value;
LABEL_93:
if( v18 )
ExFreePoolWithTag(v18, 0);
if( v6 && v6 != v5 )
ExFreePoolWithTag(v6, 0);
ExFreePoolWithTag(v14, 0);
if( v16 && v56 && EnvironmentVariable >= 0 )
*v56 = i;
return;
}
v19 = *((unsigned int *)v14 + 6);
if( (unsigned int)v19 > v9 || (v54 = (unsigned __int64)&v14[v19 + 28], v54 >= (unsigned __int64)v15) )
{
EnvironmentVariable = -1073741811;
v18 = Value;
goto LABEL_92;
}
if( (unsigned int)v19 < 8 || (strcmp(v14 + 28, (UINT8 *)"WINDOWS"), v20) )
{
v50 = 0;
v21 = 0i64;
}
else
{
if( (unsigned int)v19 <= 0x14 )
{
EnvironmentVariable = -1073741811;
LABEL_91:
v18 = Value;
v5 = Value;
goto LABEL_92;
}
EnvironmentVariable = ExpVerifyWindowsOsOptions((__int64)(v14 + 28), v19);
if( EnvironmentVariable < 0 )
goto LABEL_91;
v50 = 1;
v21 = (_FILE_PATH *)&v14[*((unsigned int *)v14 + 11) + 28];
}
v22 = &v14[HIDWORD(v48)];
Src = v22;
v23 = ExpSafeWcslen((WCHAR *)v22, v15);
if( v23 == -1 )
{
EnvironmentVariable = -1073741811;
v18 = Value;
v6 = Value;
v5 = Value;
LABEL_92:
v16 = v43;
goto LABEL_93;
}
HIDWORD(v48) = 2 * v23 + 2;
InputFilePath = (_FILE_PATH *)&v14[(unsigned int)ValueLength];
EnvironmentVariable = ExpVerifyFilePath(InputFilePath, v24);
if( EnvironmentVariable >= 0 )
{
if( v54 > (unsigned __int64)v22 || (v25 = HIDWORD(v48), &v22[HIDWORD(v48)] > (UINT8 *)InputFilePath) )
{
EnvironmentVariable = -1073741811;
}
else
{
if( InputFilePath->Type == 4 )
{
Length = InputFilePath->Length;
v47 = InputFilePath;
goto LABEL_50;
}
EnvironmentVariable = ZwTranslateFilePath(
InputFilePath,
4ui64,
0i64,
(UINT64 *)((char *)&OutputFilePathLength + 4));
if( EnvironmentVariable == -1073741789 )
{
v26 = ExAllocatePoolWithTag(0x200ui64, HIDWORD(OutputFilePathLength), 1920364101i64);
v27 = (_FILE_PATH *)v26;
v47 = (_FILE_PATH *)v26;
if( !v26 )
{
EnvironmentVariable = -1073741670;
v6 = 0i64;
LABEL_45:
v18 = Value;
LABEL_46:
v5 = InputFilePath;
goto LABEL_92;
}
memset(v26, 0i64, HIDWORD(OutputFilePathLength));
LODWORD(OutputFilePathLength) = HIDWORD(OutputFilePathLength);
EnvironmentVariable = ZwTranslateFilePath(InputFilePath, 4ui64, v27, &OutputFilePathLength);
if( EnvironmentVariable < 0 )
{
v6 = v27;
goto LABEL_45;
}
Length = HIDWORD(OutputFilePathLength);
LABEL_50:
v29 = Length - 12;
HIDWORD(OutputFilePathLength) = v29;
if( !v50 || v21->Type == 4 )
{
v30 = *((_DWORD *)v14 + 6);
}
else
{
EnvironmentVariable = ZwTranslateFilePath(v21, 4ui64, 0i64, &v48);
if( EnvironmentVariable != -1073741789 )
{
LABEL_65:
v18 = Value;
goto LABEL_57;
}
v30 = v48 + *((_DWORD *)v14 + 6) - v21->Length;
v29 = HIDWORD(OutputFilePathLength);
}
LODWORD(ValueLength) = v25 + 6 + v30 + v29;
v31 = ValueLength;
v32 = ExAllocatePoolWithTag(0x200ui64, (unsigned int)ValueLength, 1920364101i64);
v18 = v32;
Value = v32;
if( !v32 )
{
EnvironmentVariable = -1073741670;
LABEL_57:
v6 = v47;
goto LABEL_46;
}
v33 = v31;
v34 = v32;
memset(v32, 0i64, v33);
*(_DWORD *)v34 = 0;
v35 = *((_DWORD *)v14 + 3);
v36 = 0;
if( (v35 & 1) != 0 )
{
*(_DWORD *)v34 = 1;
v35 = *((_DWORD *)v14 + 3);
v36 = 1;
}
if( (v35 & 0x10) != 0 )
*(_DWORD *)v34 = v36 | 8;
*((_WORD *)v34 + 2) = WORD2(OutputFilePathLength);
v37 = HIDWORD(v48);
memmove((char *)v34 + 6, Src, HIDWORD(v48));
v38 = (char *)v34 + v37 + 6;
memmove(v38, v47->FilePath, HIDWORD(OutputFilePathLength));
v39 = &v38[HIDWORD(OutputFilePathLength)];
if( !v50 || v21->Type == 4 )
{
memmove(&v38[HIDWORD(OutputFilePathLength)], v14 + 28, v30);
}
else
{
memmove(&v38[HIDWORD(OutputFilePathLength)], v14 + 28, *((_DWORD *)v14 + 11));
*((_DWORD *)v39 + 3) = v30;
v40 = (_FILE_PATH *)&v39[*((unsigned int *)v14 + 11)];
LODWORD(OutputFilePathLength) = v48;
EnvironmentVariable = ZwTranslateFilePath(v21, 4ui64, v40, &v48);
if( EnvironmentVariable )
goto LABEL_65;
}
v41 = (_ETHREAD *)KeGetCurrentThread();
--v41->Tcb.KernelApcDisable;
ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
if( v43 )
{
for( i = 0; i <= 0xFFFF; ++i )
{
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04x", i);
LODWORD(OutputFilePathLength) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(
Dst,
(_GUID *)&EfiBootVariablesGuid,
0i64,
&OutputFilePathLength,
0i64);
if( EnvironmentVariable == -1073741568 && ((2 * ((i | (2 * i)) & 0xC4444444)) & i) != 0 )
{
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04X", i);
LODWORD(OutputFilePathLength) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(
Dst,
(_GUID *)&EfiBootVariablesGuid,
0i64,
&OutputFilePathLength,
0i64);
}
if( EnvironmentVariable == -1073741568 )
break;
if( EnvironmentVariable && EnvironmentVariable != -1073741789 )
{
v14 = (UINT8 *)P;
goto LABEL_78;
}
}
v14 = (UINT8 *)P;
if( i <= 0xFFFF )
goto LABEL_86;
EnvironmentVariable = -1073741670;
}
else
{
v14 = (UINT8 *)P;
i = *((_DWORD *)P + 2);
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04X", i);
LODWORD(OutputFilePathLength) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(
Dst,
(_GUID *)&EfiBootVariablesGuid,
0i64,
&OutputFilePathLength,
0i64);
if( EnvironmentVariable == -1073741568
&& ((2 * ((*((_DWORD *)v14 + 2) | (2 * *((_DWORD *)v14 + 2))) & 0xC4444444)) & *((_DWORD *)v14 + 2)) != 0 )
{
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04x");
LODWORD(OutputFilePathLength) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(
Dst,
(_GUID *)&EfiBootVariablesGuid,
0i64,
&OutputFilePathLength,
0i64);
}
if( !EnvironmentVariable || EnvironmentVariable == -1073741789 )
{
LABEL_86:
LODWORD(Attributes) = 1;
v18 = Value;
EnvironmentVariable = IoSetEnvironmentVariableEx(
Dst,
(_GUID *)&EfiBootVariablesGuid,
Value,
(unsigned int)ValueLength,
(UINT64)Attributes);
goto LABEL_79;
}
}
LABEL_78:
v18 = Value;
LABEL_79:
ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
KeLeaveCriticalRegion();
goto LABEL_57;
}
}
}
v18 = Value;
v6 = Value;
goto LABEL_46;
}
}Referenced by:
NtAddBootEntry
NtModifyBootEntry