BiConvertBootEnvironmentDeviceToUnknown
INT64 __fastcall BiConvertBootEnvironmentDeviceToUnknown(UINT8 *Src, UINT8 **a2, UINT64 *a3){
unsigned int v4;
UINT8 *PoolWithTag;
unsigned int v8;
UINT8 *v9;
v4 = *((_DWORD *)Src + 2) + 20;
if( *((_DWORD *)Src + 2) >= 0xFFFFFFEC )
{
return(unsigned int)-1073741675;
}
else
{
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v4, 0x4B444342ui64);
v8 = 0;
v9 = PoolWithTag;
if( PoolWithTag )
{
memset((INT64)PoolWithTag, 0i64);
*(_DWORD *)v9 = 5;
memmove(v9 + 20, Src, *((unsigned int *)Src + 2));
*a2 = v9;
*(_DWORD *)a3 = v4;
}
else
{
return(unsigned int)-1073741670;
}
}
return v8;
}Referenced by:
BiConvertBootEnvironmentDeviceToNt
BiConvertRegistryDataToElement