NtQueryBootEntryOrder

INT64 __fastcall NtQueryBootEntryOrder(UINT64 *Ids, UINT64 *Count){
  INT64 result; 
  INT8 v5; 
  __int64 v6; 
  unsigned int v7; 
  _ETHREAD *v8; 
  int EnvironmentVariable; 
  unsigned int v10; 
  __int64 v11; 
  unsigned __int16 *v12; 
  _DWORD *i; 
  unsigned int v14; 
  PVOID Value; 
  PVOID P; 
  _ETHREAD *CurrentThread; 
  UINT64 Length; 
  Value = 0i64;
  LODWORD(Length) = 0;
  P = 0i64;
  if( dword_140C19650 != 2 )
    return 3221225474i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = *((_BYTE *)CurrentThread + 562);
  if( v5 )
  {
    v6 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)Count < 0x7FFFFFFF0000i64 )
      v6 = (__int64)Count;
    *(_DWORD *)v6 = *(_DWORD *)v6;
    v7 = 4 * *(_DWORD *)Count;
    LODWORD(Length) = v7;
    if( !Ids )
    {
      LODWORD(Length) = 0;
      v7 = 0;
    }
    if( v7 )
      ProbeForWrite(Ids, v7, 4ui64);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, v5) )
      return 3221225569i64;
  }
  else
  {
    LODWORD(Length) = Ids != 0i64 ? 4 * *(_DWORD *)Count : 0;
  }
  if( !(_DWORD)Length
    || (result = ExLockUserBuffer(Ids, (unsigned int)Length, v5, IoWriteAccess, &Value, &P), (int)result >= 0) )
  {
    LODWORD(Length) = (unsigned int)Length >> 1;
    v8 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v8 + 242);
    ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
    EnvironmentVariable = IoGetEnvironmentVariableEx(
                            (WCHAR *)L"BootOrder",
                            (GUID *)&EfiBootVariablesGuid,
                            Value,
                            &Length,
                            0i64);
    ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( EnvironmentVariable < 0 )
    {
      if( EnvironmentVariable == -1073741568 )
      {
        LODWORD(Length) = 0;
        EnvironmentVariable = 0;
      }
    }
    else
    {
      v10 = (unsigned int)Length >> 1;
      v11 = ((unsigned int)Length >> 1) - 1;
      v12 = (unsigned __int16 *)((char *)Value + 2 * v11);
      for( i = (char *)Value + 4 * v11; v10; --v10 )
        *i-- = *v12--;
    }
    v14 = 2 * Length;
    LODWORD(Length) = 2 * Length;
    if( P )
    {
      ExUnlockUserBuffer(P);
      v14 = Length;
    }
    *(_DWORD *)Count = v14 >> 2;
    return(unsigned int)EnvironmentVariable;
  }
  return result;
}

Referenced by: