NtEnumerateDriverEntries

NTSTATUS __stdcall NtEnumerateDriverEntries(PVOID Buffer, UINT64 *a2){
  UINT64 *v2; 
  unsigned int *v4; 
  NTSTATUS result; 
  INT8 v6; 
  __int64 v7; 
  unsigned int v8; 
  INT64 v9; 
  NTSTATUS v10; 
  _DWORD *v11; 
  _ETHREAD *v12; 
  int v13; 
  unsigned int *PoolWithTag; 
  unsigned int *v15; 
  __int64 v16; 
  WCHAR *v17; 
  unsigned int v18; 
  __int64 v19; 
  unsigned int v20; 
  unsigned int v21; 
  unsigned __int64 v22; 
  unsigned int v23; 
  BOOL v24; 
  unsigned int v25; 
  BOOL v26; 
  BOOL v27; 
  unsigned int v28; 
  unsigned int v29; 
  __int64 v30; 
  UINT64 v31; 
  __int64 v32; 
  VOID **LockedBuffer; 
  VOID **LockedBuffera; 
  BOOL v35; 
  UINT64 Id; 
  unsigned int v37; 
  unsigned int v38; 
  NTSTATUS v39; 
  unsigned int v40; 
  UINT64 Attributes; 
  PVOID P; 
  PVOID Max; 
  size_t Size; 
  void *Src; 
  UINT8 *v46; 
  _ETHREAD *CurrentThread; 
  SIZE_T NumberOfBytes; 
  v2 = a2;
  Attributes = 0i64;
  P = 0i64;
  v4 = 0i64;
  if( dword_140C19650 != 2 )
    return -1073741822;
  if( (PVOID)((unsigned __int64)Buffer & 0xFFFFFFFFFFFFFFFCui64) != Buffer )
    return -1073741811;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = *((_BYTE *)CurrentThread + 562);
  if( v6 )
  {
    v7 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)a2 < 0x7FFFFFFF0000i64 )
      v7 = (__int64)a2;
    *(_DWORD *)v7 = *(_DWORD *)v7;
    v8 = Buffer != 0i64 ? *(_DWORD *)a2 : 0;
    if( v8 )
      ProbeForWrite(Buffer, v8, 4ui64);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, v6) )
      return -1073741727;
  }
  else
  {
    v8 = Buffer != 0i64 ? *(_DWORD *)a2 : 0;
  }
  if( !v8 || (result = ExLockUserBuffer(Buffer, v8, v6, IoWriteAccess, (VOID **)&Attributes, &P), result >= 0) )
  {
    v9 = Attributes;
    v10 = 0;
    v35 = v8 != 0;
    v11 = 0i64;
    v12 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v12 + 242);
    ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
    LODWORD(NumberOfBytes) = 0;
    v13 = IoEnumerateEnvironmentVariablesEx(
            (WCHAR *)2,
            (GUID *)ExpIsDriverEntry,
            0i64,
            &NumberOfBytes,
            (UINT64 *)LockedBuffer);
    if( v13 == -1073741789 )
    {
      PoolWithTag = (unsigned int *)ExAllocatePoolWithTag(NonPagedPoolNx, (unsigned int)NumberOfBytes, 0x72766E45ui64);
      v4 = PoolWithTag;
      if( PoolWithTag )
        v13 = IoEnumerateEnvironmentVariablesEx(
                (WCHAR *)2,
                (GUID *)ExpIsDriverEntry,
                PoolWithTag,
                &NumberOfBytes,
                (UINT64 *)LockedBuffera);
      else
        v13 = -1073741670;
    }
    else
    {
      LODWORD(NumberOfBytes) = 0;
    }
    ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( v13 || !(_DWORD)NumberOfBytes )
      goto LABEL_53;
    v15 = v4;
    Max = (char *)v4 + 2 * (unsigned int)NumberOfBytes;
    while( 1 )
    {
      LODWORD(Id) = 0;
      v16 = *((_QWORD *)v15 + 2) - *(_QWORD *)&EfiDriverVariablesGuid.Data1;
      if( !v16 )
        v16 = *((_QWORD *)v15 + 3) - *(_QWORD *)EfiDriverVariablesGuid.Data4;
      if( !v16 && (unsigned int)ExpTranslateDriverEntryNameToId((PWCHAR)v15 + 16, &Id) && v15[2] >= 8 )
      {
        v17 = (WCHAR *)((char *)v15 + v15[1]);
        v38 = v17[2];
        Src = v17 + 3;
        v18 = ExpSafeWcslen(v17 + 3, Max);
        if( v18 != -1 )
          v18 = 2 * v18 + 2;
        if( v18 != -1 && v21 < v20 && v20 >= v21 + v18 + 6 )
          break;
      }
LABEL_49:
      v32 = *v15;
      if( !(_DWORD)v32 )
      {
        v2 = a2;
        if( v11 )
          *v11 = 0;
LABEL_53:
        if( v4 )
          ExFreePoolWithTag(v4, 0);
        if( P )
          ExUnlockUserBuffer(P);
        if( v13 < 0 )
          v10 = v13;
        *(_DWORD *)v2 = v9 - Attributes;
        return v10;
      }
      v15 = (unsigned int *)((char *)v15 + v32);
    }
    Size = v18;
    v46 = (UINT8 *)(v19 + v18 + 6i64);
    v22 = (v9 + 3) & 0xFFFFFFFFFFFFFFFCui64;
    if( v22 != v9 )
    {
      v23 = v22 - v9;
      v9 = (v9 + 3) & 0xFFFFFFFFFFFFFFFCui64;
      if( v8 < v23 )
      {
        v24 = 0;
        v8 = 0;
        v10 = -1073741789;
LABEL_38:
        HIDWORD(Id) = (v18 + 23) & 0xFFFFFFFC;
        v37 = v21 + HIDWORD(Id) + 12;
        v25 = v37 + 4;
        v40 = v37 + 4;
        if( v8 < v37 + 4 )
          v10 = -1073741789;
        v39 = v10;
        v26 = 0;
        if( v8 >= v25 )
          v26 = v24;
        v27 = v26;
        v35 = v26;
        v28 = v8;
        v29 = v8 - v25;
        v8 = 0;
        if( v28 >= v25 )
          v8 = v29;
        if( v27 )
        {
          memset(v9, 0i64);
          *(_DWORD *)(v9 + 4) = 1;
          *(_DWORD *)(v9 + 8) = v37;
          *(_DWORD *)(v9 + 12) = Id;
          *(_DWORD *)(v9 + 16) = 20;
          *(_DWORD *)(v9 + 20) = HIDWORD(Id);
          memmove((UINT8 *)(v9 + 24), (UINT8 *)Src, Size);
          v30 = v9 + 4 + HIDWORD(Id);
          *(_DWORD *)v30 = 1;
          v31 = v38;
          *(_DWORD *)(v30 + 4) = v38 + 12;
          *(_DWORD *)(v30 + 8) = 4;
          memmove((UINT8 *)(v30 + 12), v46, v31);
          if( v11 )
            *v11 = v9 - (_DWORD)v11;
          v11 = (_DWORD *)v9;
          v10 = v39;
          v25 = v40;
        }
        v9 += v25;
        goto LABEL_49;
      }
      v8 -= v23;
    }
    v24 = v35;
    goto LABEL_38;
  }
  return result;
}

Referenced by: