BiGetFilePathFromEfiPath

NTSTATUS __fastcall BiGetFilePathFromEfiPath(__int64 a1, _QWORD *a2, unsigned int *a3){
  char v3; 
  NTSTATUS result; 
  int v8; 
  __int64 i; 
  unsigned int v10; 
  UINT8 *PoolWithTag; 
  UINT8 *v12; 
  UINT8 *v13; 
  __int64 j; 
  unsigned int v15; 
  UINT64 pulResult; 
  v3 = *(_BYTE *)a1 & 0x7F;
  LODWORD(pulResult) = 0;
  if( v3 == 127 )
    return -1073741766;
  v8 = 0;
  for( i = a1 + *(unsigned __int16 *)(a1 + 2); (*(_BYTE *)i & 0x7F) != 127; i += *(unsigned __int16 *)(i + 2) )
  {
    if( *(_BYTE *)i == 4 && *(_BYTE *)(i + 1) == 4 )
    {
      result = RtlULongSub(*(unsigned __int16 *)(i + 2), 4ui64, &pulResult);
      if( result < 0 )
        return result;
      v8 += pulResult;
    }
  }
  if( !v8 )
    return -1073741275;
  v10 = v8 + 2;
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v10, 0x4B444342ui64);
  v12 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  v13 = PoolWithTag;
  for( j = a1 + *(unsigned __int16 *)(a1 + 2); (*(_BYTE *)j & 0x7F) != 127; j += *(unsigned __int16 *)(j + 2) )
  {
    if( *(_BYTE *)j == 4 && *(_BYTE *)(j + 1) == 4 )
    {
      v15 = *(unsigned __int16 *)(j + 2) - 4;
      memmove(v13, (UINT8 *)(j + 4), v15);
      v13 += v15;
    }
  }
  result = 0;
  *a2 = v12;
  *(_WORD *)v13 = 0;
  *a3 = v10;
  return result;
}

Referenced by: