SiGetEfiSystemDevice

INT64 __fastcall SiGetEfiSystemDevice(INT64 a1, INT64 a2, CHAR **a3){
  PWCHAR v3; 
  CHAR **v4; 
  PWCHAR *v5; 
  void *v6; 
  unsigned int v7; 
  int v8; 
  WCHAR *PoolWithTag; 
  NTSTATUS EspFromFirmware; 
  WCHAR v11; 
  unsigned int v12; 
  UINT64 i; 
  NTSTATUS DirectoryObject; 
  PWCHAR *v15; 
  char v16; 
  PVOID v17; 
  UINT64 v18; 
  int DriveLayoutInformation; 
  unsigned int v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  int v24; 
  UINT64 SystemPartition; 
  int v27; 
  char SystemDisk[12]; 
  void *DirectoryHandle; 
  PVOID P; 
  PWCHAR v31; 
  CHAR **v32; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 OutputBuffer[2]; 
  __int128 v36; 
  __int128 v37; 
  v27 = a1;
  v32 = a3;
  v3 = 0i64;
  DirectoryHandle = 0i64;
  v4 = a3;
  v5 = 0i64;
  v31 = 0i64;
  v6 = 0i64;
  memset(SystemDisk, 0, sizeof(SystemDisk));
  v7 = 0;
  SystemPartition = 0i64;
  v8 = 0;
  memset(OutputBuffer, 0, 12);
  v36 = 0i64;
  v37 = 0i64;
  DestinationString = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x6Aui64, 0x4B505953ui64);
  if( !PoolWithTag )
  {
    EspFromFirmware = -1073741801;
    goto LABEL_56;
  }
  if( SiDisambiguateSystemDevice((UINT64 *)SystemDisk, &SystemPartition) >= 0 )
    goto LABEL_45;
  RtlInitUnicodeString(&DestinationString, L"\\Device", v11);
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  EspFromFirmware = ZwOpenDirectoryObject(&DirectoryHandle, 1ui64, &ObjectAttributes);
  if( EspFromFirmware < 0 )
    goto LABEL_50;
  v12 = 4096;
  for( i = 4096i64; ; i = v12 )
  {
    v5 = (PWCHAR *)ExAllocatePoolWithTag(PagedPool, i, 0x4B505953ui64);
    P = v5;
    if( !v5 )
    {
      EspFromFirmware = -1073741801;
      goto LABEL_50;
    }
    HIDWORD(SystemPartition) = 0;
    DirectoryObject = ZwQueryDirectoryObject(
                        DirectoryHandle,
                        v5,
                        v12,
                        0,
                        1u,
                        (UINT64 *)((char *)&SystemPartition + 4),
                        0i64);
    EspFromFirmware = DirectoryObject;
    if( DirectoryObject != 261 )
      break;
    ExFreePoolWithTag(v5, 0);
    v12 += 4096;
  }
  if( (int)(DirectoryObject + 0x80000000) >= 0 && DirectoryObject != -2147483622 )
  {
LABEL_43:
    if( EspFromFirmware < 0 )
      goto LABEL_50;
    v3 = v31;
    v4 = v32;
LABEL_45:
    v27 = -v27;
    if( v3 )
      v24 = RtlStringCbPrintfW(PoolWithTag, 0x6Aui64, (WCHAR *)L"\\Device\\%s\\Partition%lu");
    else
      v24 = RtlStringCbPrintfW(PoolWithTag, 0x6Aui64, (WCHAR *)L"\\Device\\Harddisk%lu\\Partition%lu");
    EspFromFirmware = v24;
    if( v24 >= 0 )
    {
      *v4 = (CHAR *)PoolWithTag;
      goto LABEL_52;
    }
LABEL_50:
    ExFreePoolWithTag(PoolWithTag, 0);
    goto LABEL_52;
  }
  if( !*(_WORD *)v5 )
  {
LABEL_47:
    EspFromFirmware = -1073740718;
    goto LABEL_50;
  }
  v15 = v5 + 1;
  do
  {
    if( !SiIsValidDiskDevice(*v15, v15[2]) )
      goto LABEL_35;
    RtlStringCbPrintfW(PoolWithTag, 0x6Aui64, (WCHAR *)L"\\Device\\%s\\Partition%lu");
    LODWORD(OutputBuffer[0]) = 1;
    *(__int64 *)((char *)OutputBuffer + 4) = 0i64;
    v16 = 0;
    v36 = 0i64;
    v37 = 0i64;
    if( SiIssueSynchronousIoctl(PoolWithTag, v17, OutputBuffer, v18) >= 0 )
    {
      if( BYTE8(v37) == 15 )
        goto LABEL_35;
      if( BYTE8(v37) == 16 )
        v16 = 1;
    }
    if( v6 )
    {
      ExFreePoolWithTag(v6, 0);
      *(_QWORD *)&SystemDisk[4] = 0i64;
    }
    DriveLayoutInformation = SiGetDriveLayoutInformation(PoolWithTag, (DRIVE_LAYOUT_INFORMATION_EX **)&SystemDisk[4]);
    v6 = *(void **)&SystemDisk[4];
    if( DriveLayoutInformation >= 0 && **(_DWORD **)&SystemDisk[4] == 1 )
    {
      v20 = *(_DWORD *)(*(_QWORD *)&SystemDisk[4] + 4i64);
      if( v20 )
      {
        v21 = *(_QWORD *)&SystemDisk[4] + 72i64;
        v22 = v20;
        do
        {
          v23 = *(_QWORD *)(v21 + 8) - *(_QWORD *)&PARTITION_SYSTEM_GUID.Data1;
          if( !v23 )
            v23 = *(_QWORD *)(v21 + 16) - *(_QWORD *)PARTITION_SYSTEM_GUID.Data4;
          if( !v23 )
          {
            if( !v7 || !v8 && v16 )
            {
              v31 = *v15;
              LODWORD(SystemPartition) = *(_DWORD *)v21;
            }
            ++v7;
            if( v16 )
              ++v8;
          }
          v21 += 144i64;
          --v22;
        }
        while( v22 );
      }
    }
LABEL_35:
    v15 += 4;
  }
  while( *((_WORD *)v15 - 4) );
  v5 = (PWCHAR *)P;
  if( !v7 )
    goto LABEL_47;
  if( v7 <= 1 || v8 == 1 )
  {
    EspFromFirmware = 0;
    goto LABEL_43;
  }
  EspFromFirmware = SiGetEspFromFirmware(PoolWithTag);
  if( EspFromFirmware < 0 )
  {
    EspFromFirmware = -1073740719;
    goto LABEL_50;
  }
  *v32 = (CHAR *)PoolWithTag;
LABEL_52:
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  if( v5 )
    ExFreePoolWithTag(v5, 0);
LABEL_56:
  if( DirectoryHandle )
    ZwClose(DirectoryHandle);
  return(unsigned int)EspFromFirmware;
}

Referenced by: