ExpRevokeBootLoaderPagePrivileges

VOID **__fastcall ExpRevokeBootLoaderPagePrivileges(INT64 a1){
  VOID **result; 
  INT64 v2; 
  __int64 *i; 
  _PREFIX_TABLE *v4; 
  unsigned __int64 v5; 
  _STRING FullName; 
  void *retaddr; 

  result = &retaddr;
  FullName.Buffer = 0i64;
  v2 = a1 + 32;
  *(_QWORD *)&FullName.Length = 0i64;
  for( i = *(__int64 **)(a1 + 32); i != (__int64 *)v2; i = (__int64 *)*i )
  {
    if( *((_DWORD *)i + 4) == 4 )
    {
      v4 = (_PREFIX_TABLE *)i[3];
      v5 = (unsigned __int64)&v4[-1].NextPrefixTree + i[4] + 7;
      while( (unsigned __int64)v4 <= v5 )
      {
        result = (VOID **)KeSetPagePrivilege(v4, &FullName, 16);
        v4 = (_PREFIX_TABLE *)((char *)v4 + 1);
      }
    }
  }
  return result;
}

Referenced by: