IopLoadBootHotPatches

NTSTATUS __stdcall IopLoadBootHotPatches(){
  INT64 v0; 
  VOID **PoolWithTag; 
  int v3; 
  unsigned int v4; 
  NTSTATUS v5; 
  NTSTATUS v6; 
  unsigned int v7; 
  __int64 v8; 
  int v9; 
  NTSTATUS v10; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 NumberOfBytes; 
  WCHAR *endptr; 
  VOID *KeyHandle; 
  _UNICODE_STRING SourceString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  WCHAR nptr[8]; 
  __int16 v20; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  KeyHandle = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"vx";
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  LODWORD(NumberOfBytes) = 0;
  SourceString = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 9ui64, &ObjectAttributes, v0, Length, (INT64)ResultLength, NumberOfBytes, 0i64) < 0 )
    return 1;
  PoolWithTag = 0i64;
  v20 = 0;
  v3 = 0;
  v4 = 0;
  while( 1 )
  {
    while( 1 )
    {
      LODWORD(Lengtha) = v3;
      v5 = ZwEnumerateValueKey(KeyHandle, v4, KeyValueFullInformation, PoolWithTag, Lengtha, &NumberOfBytes);
      v6 = v5;
      if( v5 < 0 )
        break;
      if( *((_DWORD *)PoolWithTag + 1) == 3 )
      {
        v7 = *((_DWORD *)PoolWithTag + 3);
        if( v7 >= 4 )
        {
          v8 = *((unsigned int *)PoolWithTag + 2);
          v9 = *(unsigned __int16 *)((char *)PoolWithTag + v8);
          if( (v9 & 1) == 0 && v9 + 2 == v7 && *((_DWORD *)PoolWithTag + 4) == 32 )
          {
            *(_OWORD *)nptr = *(_OWORD *)((char *)PoolWithTag + 20);
            wcstoul(nptr, &endptr, 16i64);
            if( endptr == (WCHAR *)&v20 )
            {
              *(_OWORD *)nptr = *(_OWORD *)((char *)PoolWithTag + 36);
              wcstoul(nptr, &endptr, 16i64);
              if( endptr == (WCHAR *)&v20 )
              {
                SourceString.Buffer = (wchar_t *)((char *)PoolWithTag + v8 + 2);
                SourceString.Length = *(_WORD *)((char *)PoolWithTag + v8);
                SourceString.MaximumLength = SourceString.Length;
                v10 = MmRegisterHotPatch(&SourceString);
                v6 = v10;
                if( v10 < 0 && v10 != -1073741515 && v10 != -1073741735 )
                  goto LABEL_25;
              }
            }
          }
        }
      }
      ++v4;
    }
    if( v5 != -1073741789 && v5 != -2147483643 )
      break;
    if( PoolWithTag )
      ExFreePoolWithTag(PoolWithTag, 0);
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1883795273i64);
    if( !PoolWithTag )
    {
      v6 = -1073741670;
      goto LABEL_25;
    }
    v3 = NumberOfBytes;
  }
  if( v5 == -2147483622 )
    v6 = 0;
LABEL_25:
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  ZwClose((_HANDLE)KeyHandle);
  return v6;
}

Referenced by: