RtlInitializeBootStatDataCache
NTSTATUS __stdcall RtlInitializeBootStatDataCache(){
int v0;
VOID **Buffer;
NTSTATUS v2;
_IO_STATUS_BLOCK IoStatusBlock;
UINT64 NumberOfBytes;
_LARGE_INTEGER ByteOffset;
LODWORD(NumberOfBytes) = 0;
IoStatusBlock = 0i64;
if( BootStatDataCache )
return 0;
ByteOffset.QuadPart = 0i64;
v0 = ZwReadFile(BootStatFileHandle, 0, 0i64, 0i64, &IoStatusBlock, &NumberOfBytes, 4u, &ByteOffset, 0i64);
if( v0 >= 0 )
{
if( (_DWORD)NumberOfBytes && (unsigned int)NumberOfBytes <= 0x800 )
{
Buffer = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1717859170i64);
BootStatDataCache = Buffer;
if( Buffer )
{
v0 = ZwReadFile(BootStatFileHandle, 0, 0i64, 0i64, &IoStatusBlock, Buffer, NumberOfBytes, &ByteOffset, 0i64);
if( v0 >= 0 )
{
v2 = v0;
if( IoStatusBlock.Information != (unsigned int)NumberOfBytes )
return -1073741823;
return v2;
}
}
else
{
return -1073741801;
}
}
else
{
return -1073741823;
}
}
return v0;
}Referenced by:
RtlLockBootStatusData