ExpSetBootEntry
VOID __stdcall ExpSetBootEntry(){
UINT8 *v0;
int v1;
unsigned int *v2;
UINT8 *v3;
unsigned int i;
PVOID v5;
PVOID v6;
INT8 v7;
unsigned __int64 v8;
unsigned int v9;
UINT64 v10;
unsigned __int64 v11;
__int64 v12;
CHAR *PoolWithTag;
CHAR *v14;
CHAR *v15;
int v16;
int EnvironmentVariable;
PVOID v18;
__int64 v19;
__int64 v20;
CHAR *v21;
int v22;
VOID *v23;
int v24;
struct _FILE_PATH *v25;
struct _FILE_PATH *v26;
int v27;
ULONG Length;
ULONG v29;
int v30;
ULONG v31;
char *v32;
char *v33;
int v34;
int v35;
UINT8 *v36;
int v37;
_ETHREAD *v38;
UINT64 *Attributes;
int v40;
UINT64 v41;
PVOID P;
PFILE_PATH InputFilePath;
PFILE_PATH v44;
ULONG v45;
unsigned int Size;
int v48;
UINT64 ValueLength;
PVOID v50;
unsigned int v51;
unsigned __int64 v52;
void *Src;
unsigned int *v54;
_ETHREAD *CurrentThread;
wchar_t Dst[12];
v54 = v2;
v3 = v0;
v40 = v1;
v50 = 0i64;
i = 0;
v5 = 0i64;
v6 = 0i64;
P = 0i64;
v45 = 0;
v41 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v7 = *((_BYTE *)CurrentThread + 562);
v8 = (unsigned __int64)(v3 + 4);
if( v7 )
{
if( v8 >= 0x7FFFFFFF0000i64 )
v8 = 0x7FFFFFFF0000i64;
v9 = *(_DWORD *)v8;
v51 = *(_DWORD *)v8;
}
else
{
v9 = *(_DWORD *)v8;
v51 = *(_DWORD *)v8;
}
if( v9 >= 0x1C )
{
if( v7 )
{
if( ((unsigned __int8)v3 & 3) != 0 )
ExRaiseDatatypeMisalignment();
v10 = v9;
v11 = (unsigned __int64)&v3[v9];
if( v11 > 0x7FFFFFFF0000i64 || v11 < (unsigned __int64)v3 )
MEMORY[0x7FFFFFFF0000] = 0;
if( v2 )
{
v12 = (__int64)v2;
if( (unsigned __int64)v2 >= 0x7FFFFFFF0000i64 )
v12 = 0x7FFFFFFF0000i64;
*(_DWORD *)v12 = *(_DWORD *)v12;
v9 = v51;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, v7) )
return;
}
else
{
v10 = v9;
}
PoolWithTag = (CHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, v10, 0x72766E45ui64);
v14 = PoolWithTag;
v50 = PoolWithTag;
if( !PoolWithTag )
return;
memmove((UINT8 *)PoolWithTag, v3, v10);
v15 = &v14[v10];
v16 = v40;
if( *(_DWORD *)v14 != 1
|| !v40 && *((_DWORD *)v14 + 2) > 0xFFFFu
|| (*((_DWORD *)v14 + 3) &= 0x13u, Size = *((_DWORD *)v14 + 4), (Size & 1) != 0)
|| (LODWORD(ValueLength) = *((_DWORD *)v14 + 5), (ValueLength & 3) != 0) )
{
EnvironmentVariable = -1073741811;
v18 = P;
LABEL_93:
if( v18 )
ExFreePoolWithTag(v18, 0);
if( v6 && v6 != v5 )
ExFreePoolWithTag(v6, 0);
ExFreePoolWithTag(v14, 0);
if( v16 && v54 && EnvironmentVariable >= 0 )
*v54 = i;
return;
}
v19 = *((unsigned int *)v14 + 6);
if( (unsigned int)v19 > v9 || (v52 = (unsigned __int64)&v14[v19 + 28], v52 >= (unsigned __int64)v15) )
{
EnvironmentVariable = -1073741811;
v18 = P;
goto LABEL_92;
}
if( (unsigned int)v19 >= 8 && !(unsigned int)strcmp(v14 + 28, "WINDOWS") )
{
if( (unsigned int)v19 <= 0x14 )
{
EnvironmentVariable = -1073741811;
LABEL_91:
v18 = P;
v5 = P;
goto LABEL_92;
}
EnvironmentVariable = ExpVerifyWindowsOsOptions((__int64)(v14 + 28), v19);
if( EnvironmentVariable < 0 )
goto LABEL_91;
v48 = 1;
v20 = (__int64)&v14[*((unsigned int *)v14 + 11) + 28];
}
else
{
v48 = 0;
v20 = 0i64;
}
v21 = &v14[Size];
Src = v21;
v22 = ExpSafeWcslen((PWCHAR)v21, v15);
if( v22 == -1 )
{
EnvironmentVariable = -1073741811;
v18 = P;
v6 = P;
v5 = P;
LABEL_92:
v16 = v40;
goto LABEL_93;
}
Size = 2 * v22 + 2;
InputFilePath = (PFILE_PATH)&v14[(unsigned int)ValueLength];
EnvironmentVariable = ExpVerifyFilePath((UINT64)InputFilePath, v23);
if( EnvironmentVariable >= 0 )
{
if( v52 > (unsigned __int64)v21 || &v21[Size] > (CHAR *)InputFilePath )
{
EnvironmentVariable = -1073741811;
}
else
{
if( InputFilePath->Type == 4 )
{
Length = InputFilePath->Length;
v44 = InputFilePath;
goto LABEL_50;
}
ZwTranslateFilePath();
EnvironmentVariable = v24;
if( v24 == -1073741789 )
{
v25 = (struct _FILE_PATH *)ExAllocatePoolWithTag(NonPagedPoolNx, HIDWORD(v41), 0x72766E45ui64);
v26 = v25;
v44 = v25;
if( !v25 )
{
EnvironmentVariable = -1073741670;
v6 = 0i64;
LABEL_45:
v18 = P;
LABEL_46:
v5 = InputFilePath;
goto LABEL_92;
}
memset((INT64)v25, 0i64);
LODWORD(v41) = HIDWORD(v41);
ZwTranslateFilePath();
EnvironmentVariable = v27;
if( v27 < 0 )
{
v6 = v26;
goto LABEL_45;
}
Length = HIDWORD(v41);
LABEL_50:
v29 = Length - 12;
HIDWORD(v41) = v29;
if( !v48 || *(_DWORD *)(v20 + 8) == 4 )
{
v31 = *((_DWORD *)v14 + 6);
}
else
{
ZwTranslateFilePath();
EnvironmentVariable = v30;
if( v30 != -1073741789 )
{
LABEL_65:
v18 = P;
goto LABEL_57;
}
v31 = v45 + *((_DWORD *)v14 + 6) - *(_DWORD *)(v20 + 4);
v29 = HIDWORD(v41);
}
LODWORD(ValueLength) = Size + 6 + v31 + v29;
v32 = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, (unsigned int)ValueLength, 0x72766E45ui64);
v18 = v32;
P = v32;
if( !v32 )
{
EnvironmentVariable = -1073741670;
LABEL_57:
v6 = v44;
goto LABEL_46;
}
v33 = v32;
memset((INT64)v32, 0i64);
*(_DWORD *)v33 = 0;
v34 = *((_DWORD *)v14 + 3);
v35 = 0;
if( (v34 & 1) != 0 )
{
*(_DWORD *)v33 = 1;
v34 = *((_DWORD *)v14 + 3);
v35 = 1;
}
if( (v34 & 0x10) != 0 )
*(_DWORD *)v33 = v35 | 8;
*((_WORD *)v33 + 2) = WORD2(v41);
memmove((UINT8 *)v33 + 6, (UINT8 *)Src, Size);
v36 = (UINT8 *)&v33[Size + 6];
memmove(v36, (UINT8 *)v44->FilePath, HIDWORD(v41));
if( !v48 || *(_DWORD *)(v20 + 8) == 4 )
{
memmove(&v36[HIDWORD(v41)], (UINT8 *)v14 + 28, v31);
}
else
{
memmove(&v36[HIDWORD(v41)], (UINT8 *)v14 + 28, *((unsigned int *)v14 + 11));
*(_DWORD *)&v36[HIDWORD(v41) + 12] = v31;
LODWORD(v41) = v45;
ZwTranslateFilePath();
EnvironmentVariable = v37;
if( v37 )
goto LABEL_65;
}
v38 = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)v38 + 242);
ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
if( v40 )
{
for( i = 0; i <= 0xFFFF; ++i )
{
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04x");
LODWORD(v41) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(Dst, (GUID *)&EfiBootVariablesGuid, 0i64, &v41, 0i64);
if( EnvironmentVariable == -1073741568 && ((2 * ((i | (2 * i)) & 0xC4444444)) & i) != 0 )
{
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04X");
LODWORD(v41) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(Dst, (GUID *)&EfiBootVariablesGuid, 0i64, &v41, 0i64);
}
if( EnvironmentVariable == -1073741568 )
break;
if( EnvironmentVariable && EnvironmentVariable != -1073741789 )
{
v14 = (CHAR *)v50;
goto LABEL_78;
}
}
v14 = (CHAR *)v50;
if( i <= 0xFFFF )
goto LABEL_86;
EnvironmentVariable = -1073741670;
}
else
{
v14 = (CHAR *)v50;
i = *((_DWORD *)v50 + 2);
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04X");
LODWORD(v41) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(Dst, (GUID *)&EfiBootVariablesGuid, 0i64, &v41, 0i64);
if( EnvironmentVariable == -1073741568
&& ((2 * ((*((_DWORD *)v14 + 2) | (2 * *((_DWORD *)v14 + 2))) & 0xC4444444)) & *((_DWORD *)v14 + 2)) != 0 )
{
swprintf_s(Dst, 9ui64, (WCHAR *)L"Boot%04x");
LODWORD(v41) = 0;
EnvironmentVariable = IoGetEnvironmentVariableEx(Dst, (GUID *)&EfiBootVariablesGuid, 0i64, &v41, 0i64);
}
if( !EnvironmentVariable || EnvironmentVariable == -1073741789 )
{
LABEL_86:
LODWORD(Attributes) = 1;
v18 = P;
EnvironmentVariable = IoSetEnvironmentVariableEx(
Dst,
(GUID *)&EfiBootVariablesGuid,
P,
(unsigned int)ValueLength,
(UINT64)Attributes);
goto LABEL_79;
}
}
LABEL_78:
v18 = P;
LABEL_79:
ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
KeLeaveCriticalRegion();
goto LABEL_57;
}
}
}
v18 = P;
v6 = P;
goto LABEL_46;
}
}Referenced by:
NtAddBootEntry
NtModifyBootEntry