NtQueryBootEntryOrder

NTSTATUS __stdcall NtQueryBootEntryOrder(UINT64 *Ids, UINT64 *Count){
  NTSTATUS result; 
  INT8 PreviousMode; 
  __int64 v6; 
  unsigned int v7; 
  _ETHREAD *v8; 
  int EnvironmentVariable; 
  unsigned int v10; 
  __int64 v11; 
  unsigned __int16 *v12; 
  _DWORD *i; 
  unsigned int v14; 
  VOID *Value; 
  VOID *LockVariable; 
  _ETHREAD *CurrentThread; 
  UINT64 Length; 

  Value = 0i64;
  LODWORD(Length) = 0;
  LockVariable = 0i64;
  if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
    return -1073741822;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  if( PreviousMode )
  {
    v6 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)Count < 0x7FFFFFFF0000i64 )
      v6 = (__int64)Count;
    *(_DWORD *)v6 = *(_DWORD *)v6;
    v7 = 4 * *(_DWORD *)Count;
    LODWORD(Length) = v7;
    if( !Ids )
    {
      LODWORD(Length) = 0;
      v7 = 0;
    }
    if( v7 )
      ProbeForWrite((UINT64)Ids, v7, 4i64);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
      return -1073741727;
  }
  else
  {
    LODWORD(Length) = Ids != 0i64 ? 4 * *(_DWORD *)Count : 0;
  }
  if( !(_DWORD)Length
    || (result = ExLockUserBuffer(Ids, (unsigned int)Length, PreviousMode, IoWriteAccess, &Value, &LockVariable),
        result >= 0) )
  {
    LODWORD(Length) = (unsigned int)Length >> 1;
    v8 = (_ETHREAD *)KeGetCurrentThread();
    --v8->Tcb.KernelApcDisable;
    ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
    EnvironmentVariable = IoGetEnvironmentVariableEx(
                            (WCHAR *)L"BootOrder",
                            (_GUID *)&EfiBootVariablesGuid,
                            Value,
                            &Length,
                            0i64);
    ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( EnvironmentVariable < 0 )
    {
      if( EnvironmentVariable == -1073741568 )
      {
        LODWORD(Length) = 0;
        EnvironmentVariable = 0;
      }
    }
    else
    {
      v10 = (unsigned int)Length >> 1;
      v11 = ((unsigned int)Length >> 1) - 1;
      v12 = (unsigned __int16 *)((char *)Value + 2 * v11);
      for( i = (char *)Value + 4 * v11; v10; --v10 )
        *i-- = *v12--;
    }
    v14 = 2 * Length;
    LODWORD(Length) = 2 * Length;
    if( LockVariable )
    {
      ExUnlockUserBuffer(LockVariable);
      v14 = Length;
    }
    *(_DWORD *)Count = v14 >> 2;
    return EnvironmentVariable;
  }
  return result;
}

Referenced by: