NtQueryDriverEntryOrder

NTSTATUS __fastcall NtQueryDriverEntryOrder(VOID *Buffer, UINT64 *a2){
  NTSTATUS result; 
  INT8 PreviousMode; 
  __int64 v6; 
  unsigned int v7; 
  unsigned int v8; 
  _ETHREAD *v9; 
  int EnvironmentVariable; 
  unsigned int v11; 
  __int64 v12; 
  unsigned __int16 *v13; 
  _DWORD *i; 
  unsigned int v15; 
  VOID *Value; 
  VOID *LockVariable; 
  _ETHREAD *CurrentThread; 
  UINT64 ValueLength; 

  Value = 0i64;
  LODWORD(ValueLength) = 0;
  LockVariable = 0i64;
  if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
    return -1073741822;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  if( PreviousMode )
  {
    v6 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)a2 < 0x7FFFFFFF0000i64 )
      v6 = (__int64)a2;
    *(_DWORD *)v6 = *(_DWORD *)v6;
    v7 = 4 * *(_DWORD *)a2;
    LODWORD(ValueLength) = v7;
    v8 = v7;
    if( !Buffer )
    {
      v7 = 0;
      LODWORD(ValueLength) = 0;
      v8 = 0;
    }
    if( v8 )
      ProbeForWrite((UINT64)Buffer, v8, 4i64);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
      return -1073741727;
  }
  else
  {
    v7 = Buffer != 0i64 ? 4 * *(_DWORD *)a2 : 0;
    LODWORD(ValueLength) = v7;
  }
  if( !v7 || (result = ExLockUserBuffer(Buffer, v7, PreviousMode, IoWriteAccess, &Value, &LockVariable), result >= 0) )
  {
    LODWORD(ValueLength) = v7 >> 1;
    v9 = (_ETHREAD *)KeGetCurrentThread();
    --v9->Tcb.KernelApcDisable;
    ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
    EnvironmentVariable = HalGetEnvironmentVariableEx(
                            (WCHAR *)L"DriverOrder",
                            (_GUID *)&EfiDriverVariablesGuid,
                            Value,
                            &ValueLength,
                            0i64);
    ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( EnvironmentVariable < 0 )
    {
      if( EnvironmentVariable == -1073741568 )
      {
        LODWORD(ValueLength) = 0;
        EnvironmentVariable = 0;
      }
    }
    else
    {
      v11 = (unsigned int)ValueLength >> 1;
      v12 = ((unsigned int)ValueLength >> 1) - 1;
      v13 = (unsigned __int16 *)((char *)Value + 2 * v12);
      for( i = (char *)Value + 4 * v12; v11; --v11 )
        *i-- = *v13--;
    }
    v15 = 2 * ValueLength;
    LODWORD(ValueLength) = 2 * ValueLength;
    if( LockVariable )
      ExUnlockUserBuffer(LockVariable);
    *(_DWORD *)a2 = v15 >> 2;
    return EnvironmentVariable;
  }
  return result;
}

Referenced by: