ExEnumerateSystemFirmwareTables

INT64 __stdcall ExEnumerateSystemFirmwareTables(
        UINT64 FirmwareTableProviderSignature,
        VOID *FirmwareTableBuffer,
        UINT64 BufferLength,
        UINT64 *ReturnLength){
  int v5; 
  int v7; 
  unsigned int v9; 
  UINT8 *PoolWithTag; 
  UINT8 *v11; 
  NTSTATUS SystemFirmwareTableInformation; 
  UINT64 ReturnedLength; 
  LODWORD(ReturnedLength) = 0;
  v5 = BufferLength;
  v7 = FirmwareTableProviderSignature;
  if( !FirmwareTableBuffer && (_DWORD)BufferLength )
    return 3221225485i64;
  v9 = BufferLength + 16;
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(BufferLength + 16), 0x54465241ui64);
  v11 = PoolWithTag;
  if( PoolWithTag )
  {
    *((_DWORD *)PoolWithTag + 1) = 0;
    *((_DWORD *)PoolWithTag + 2) = 0;
    *((_DWORD *)PoolWithTag + 3) = v5;
    *(_DWORD *)PoolWithTag = v7;
    SystemFirmwareTableInformation = ExpGetSystemFirmwareTableInformation(PoolWithTag, 0, v9, &ReturnedLength);
    if( ((int)(SystemFirmwareTableInformation + 0x80000000) < 0 || SystemFirmwareTableInformation == -1073741789)
      && ReturnLength )
    {
      *(_DWORD *)ReturnLength = *((_DWORD *)v11 + 3);
    }
    if( SystemFirmwareTableInformation >= 0 )
    {
      if( FirmwareTableBuffer )
        memmove((UINT8 *)FirmwareTableBuffer, v11 + 16, (unsigned int)(ReturnedLength - 16));
    }
    ExFreePoolWithTag(v11, 0x54465241u);
  }
  else
  {
    return(unsigned int)-1073741670;
  }
  return(unsigned int)SystemFirmwareTableInformation;
}

Referenced by: