ExRegisterBootDevice

NTSTATUS __stdcall ExRegisterBootDevice(_EX_BOOT_DEVICE_REGISTRATION *Registration, EX_BOOT_DEVICE_HANDLE **Handle){
  int v4; 
  VOID **PoolWithTag; 
  VOID *v6; 
  unsigned __int64 v7; 
  _QWORD *v8; 
  _QWORD *v9; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *ThreadHandle; 
  PVOID Object; 

  ThreadHandle = 0i64;
  v4 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeWaitForSingleObject((UINT64)&ExBootDevicesRemovedEvent + 32, 0, 0, 0, 0i64);
  if( !ExBootDeviceRemovalHandler )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 512;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v4 = PsCreateSystemThread(&ThreadHandle, 0, &ObjectAttributes, 0, 0i64, ExpWaitForBootDevices, 0i64);
    if( v4 >= 0 )
    {
      Object = 0i64;
      v4 = ObReferenceObjectByHandle(ThreadHandle, 0x1FFFFFui64, 0i64, 0, &Object, 0i64);
      ExBootDeviceRemovalHandler = (PKTHREAD)Object;
      ZwClose((_HANDLE)ThreadHandle);
      KeSetPriorityThread(ExBootDeviceRemovalHandler, 31);
    }
  }
  KeSetEvent((PRKEVENT)((char *)&ExBootDevicesRemovedEvent + 32), 0, 0);
  if( v4 >= 0 )
  {
    if( *Registration != 1 || !*((_QWORD *)Registration + 1) || Registration[1] || !*((_QWORD *)Registration + 3) )
      v4 = -1073741811;
    if( v4 >= 0 )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x40ui64, 1347306562i64);
      if( !PoolWithTag )
        v4 = -1073741670;
      if( v4 >= 0 )
      {
        ObfReferenceObjectWithTag(*((VOID **)Registration + 1), 0x746C6644ui64);
        v6 = (VOID *)*((_QWORD *)Registration + 2);
        if( v6 )
          ObfReferenceObjectWithTag(v6, 0x746C6644ui64);
        memset(PoolWithTag, 0i64, 0x40u);
        *(_DWORD *)PoolWithTag = 1347306562;
        *(_OWORD *)(PoolWithTag + 3) = *(_OWORD *)Registration;
        *(_OWORD *)(PoolWithTag + 5) = *((_OWORD *)Registration + 1);
        PoolWithTag[7] = (VOID *)*((_QWORD *)Registration + 4);
        v7 = (unsigned __int8)KeAcquireSpinLockRaiseToDpc(&ExBootDeviceListSpinLock);
        v8 = (_QWORD *)qword_140C191D8;
        v9 = PoolWithTag + 1;
        if( *(__int64 **)qword_140C191D8 != &ExBootDeviceList )
          __fastfail(3u);
        *v9 = &ExBootDeviceList;
        PoolWithTag[2] = v8;
        *v8 = v9;
        qword_140C191D8 = (__int64)(PoolWithTag + 1);
        KxReleaseSpinLock(&ExBootDeviceListSpinLock);
        __writecr8(v7);
        *Handle = (EX_BOOT_DEVICE_HANDLE *)PoolWithTag;
      }
    }
  }
  return v4;
}

Referenced by: