BiConvertNtDeviceToBootEnvironment
INT64 BiConvertNtDeviceToBootEnvironment(INT64 *a1, UINT64 a2, UINT64 a3, ...){
unsigned int v3;
int v4;
_QWORD *v5;
int v6;
__int64 v8;
int v9;
int v10;
int v11;
int v12;
INT64 result;
int v14;
int v15;
int v16;
int v17;
int v18;
__int64 v19;
VOID *v20;
_DWORD *v21;
int v22;
__int64 v23;
unsigned int v24;
unsigned int v25;
unsigned int v26;
INT64 *v27;
__int64 v28;
unsigned int v29;
int v30;
WCHAR *PartitionVhdFilePath;
__int64 v32;
__int64 v33;
VOID *v34;
unsigned int v35;
__int64 v36;
VOID *v37;
unsigned int v38;
UINT8 *v39;
__int64 v40;
UINT8 *v41;
unsigned int v42;
VOID *v43;
UINT8 *v44;
__int64 v45;
unsigned int v46;
VOID *v47;
VOID *PoolWithTag;
void *Src;
__int64 v50;
int v51;
PVOID P;
va_list va1;
va_list Pa;
va_start(va1, a3);
va_start(Pa, a3);
P = va_arg(va1, PVOID);
v3 = a2;
v4 = *(_DWORD *)a1;
v5 = P;
v51 = 0;
v6 = a3;
Src = 0i64;
v50 = 0i64;
v8 = 0i64;
v9 = v4 - 1;
if( !v9 )
{
if( v3 < 0x14 )
goto LABEL_10;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x48ui64, 0x4B444342ui64);
v8 = (__int64)PoolWithTag;
if( PoolWithTag )
{
memset((INT64)PoolWithTag, 0i64);
*(_DWORD *)v8 = 5;
*(_DWORD *)(v8 + 8) = 72;
goto LABEL_6;
}
goto LABEL_74;
}
v10 = v9 - 1;
if( !v10 )
{
if( v3 >= 0x16 )
{
if( BiIsVolumePartitionInformationRetained((PWCHAR)a1 + 10) )
{
v11 = BiCreatePartitionDevice((PCWSTR)a1 + 10, v6, &v50, (__int64)&v51);
v8 = v50;
v12 = v11;
if( v11 < 0 )
goto LABEL_7;
goto LABEL_6;
}
goto LABEL_11;
}
LABEL_10:
v12 = -1073741811;
goto LABEL_9;
}
v14 = v10 - 1;
if( !v14 )
{
if( v3 < 0x2E )
goto LABEL_10;
v45 = *((unsigned int *)a1 + 5);
if( !(_DWORD)v45 )
goto LABEL_10;
P = 0i64;
v12 = BiConvertNtFilePathToBootEnvironment(
(__int64)a1 + v45,
v3 - (unsigned int)v45,
(_WORD *)a1 + 12,
a3,
(PVOID *)Pa);
if( v12 < 0 )
goto LABEL_7;
v41 = (UINT8 *)P;
v46 = *((_DWORD *)P + 1) + 20;
v47 = ExAllocatePoolWithTag(PagedPool, v46, 0x4B444342ui64);
v8 = (__int64)v47;
if( v47 )
{
memset((INT64)v47, 0i64);
*(_DWORD *)v8 = 0;
v44 = (UINT8 *)(v8 + 20);
*(_DWORD *)(v8 + 8) = v46;
*(_DWORD *)(v8 + 16) = 5;
goto LABEL_68;
}
goto LABEL_73;
}
v15 = v14 - 1;
if( !v15 )
{
if( v3 < 0x2E )
goto LABEL_10;
v40 = *((unsigned int *)a1 + 5);
if( !(_DWORD)v40 )
goto LABEL_10;
P = 0i64;
v12 = BiConvertNtFilePathToBootEnvironment(
(__int64)a1 + v40,
v3 - (unsigned int)v40,
(_WORD *)a1 + 12,
a3,
(PVOID *)Pa);
if( v12 < 0 )
goto LABEL_7;
v41 = (UINT8 *)P;
v42 = *((_DWORD *)P + 1) + 40;
v43 = ExAllocatePoolWithTag(PagedPool, v42, 0x4B444342ui64);
v8 = (__int64)v43;
if( v43 )
{
memset((INT64)v43, 0i64);
*(_DWORD *)v8 = 0;
v44 = (UINT8 *)(v8 + 40);
*(_DWORD *)(v8 + 4) = 1;
*(_DWORD *)(v8 + 8) = v42;
*(_DWORD *)(v8 + 16) = 3;
LABEL_68:
memmove(v44, v41, *((unsigned int *)v41 + 1));
ExFreePoolWithTag(v41, 0x4B444342u);
goto LABEL_6;
}
LABEL_73:
ExFreePoolWithTag(v41, 0x4B444342u);
LABEL_74:
v12 = -1073741670;
goto LABEL_7;
}
v16 = v15 - 1;
if( !v16 )
{
if( v3 < 0x20 )
goto LABEL_10;
v38 = *((_DWORD *)a1 + 7);
if( v38 > 0x100000 )
goto LABEL_10;
v39 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v38, 0x4B444342ui64);
v8 = (__int64)v39;
if( v39 )
{
memmove(v39, (UINT8 *)a1 + 20, *((unsigned int *)a1 + 7));
goto LABEL_6;
}
goto LABEL_74;
}
v17 = v16 - 2;
if( !v17 )
{
if( v3 < 0x24 )
goto LABEL_10;
v37 = ExAllocatePoolWithTag(PagedPool, 0x48ui64, 0x4B444342ui64);
v8 = (__int64)v37;
if( v37 )
{
memset((INT64)v37, 0i64);
*(_DWORD *)v8 = 7;
*(_DWORD *)(v8 + 8) = 72;
*(_OWORD *)(v8 + 16) = VmbFsInterfaceTypeGuid;
*(_OWORD *)(v8 + 32) = *(_OWORD *)((char *)a1 + 20);
goto LABEL_6;
}
goto LABEL_74;
}
v18 = v17 - 1;
if( v18 )
{
if( v18 != 1 || v3 < 0x15 )
goto LABEL_10;
v19 = -1i64;
do
++v19;
while( *((_BYTE *)a1 + v19 + 20) );
v20 = ExAllocatePoolWithTag(PagedPool, (unsigned int)(v19 + 21), 0x4B444342ui64);
v8 = (__int64)v20;
if( v20 )
{
memset((INT64)v20, 0i64);
*(_QWORD *)v8 = 9i64;
*(_DWORD *)(v8 + 8) = v19 + 21;
*(_DWORD *)(v8 + 16) = v19 + 1;
strcpy_s((PSTR)(v8 + 20), (unsigned int)(v19 + 1), (PSTR)a1 + 20);
LABEL_23:
v5 = P;
LABEL_6:
v12 = 0;
goto LABEL_7;
}
LABEL_47:
v5 = P;
v12 = -1073741670;
goto LABEL_7;
}
if( v3 < 0x22 )
goto LABEL_10;
v23 = *((unsigned int *)a1 + 6);
if( v3 <= (unsigned int)v23 )
goto LABEL_10;
v24 = 30;
v25 = 0;
if( !(_DWORD)v23 )
{
LABEL_40:
v32 = -1i64;
if( *((_DWORD *)a1 + 5) == 1 )
{
v33 = -1i64;
do
++v33;
while( *((_WORD *)a1 + v33 + 16) );
v24 += 2 * v33;
}
v34 = ExAllocatePoolWithTag(PagedPool, v24, 0x4B444342ui64);
v8 = (__int64)v34;
if( v34 )
{
memset((INT64)v34, 0i64);
*(_DWORD *)v8 = 8;
*(_DWORD *)(v8 + 8) = v24;
if( *((_DWORD *)a1 + 5) )
{
*(_DWORD *)(v8 + 16) = 1;
v36 = -1i64;
do
++v36;
while( *((_WORD *)a1 + v36 + 16) );
wcscpy_s((PWCHAR)(v8 + 28), v36 + 1, (PWCHAR)a1 + 16);
do
++v32;
while( *((_WORD *)a1 + v32 + 16) );
v35 = 2 * v32 + 30;
}
else
{
*(_DWORD *)(v8 + 16) = 0;
v35 = 30;
*(_DWORD *)(v8 + 20) = *((_DWORD *)a1 + 7);
}
if( Src )
{
v21 = (_DWORD *)(v8 + v35);
*v21 = 0;
v22 = *((_DWORD *)Src + 2);
v21[4] = 6;
v21[2] = v25 * 4 + v22;
memmove((UINT8 *)&v21[v25], (UINT8 *)Src, *((unsigned int *)Src + 2));
*(_DWORD *)(v8 + 24) = v35;
}
goto LABEL_23;
}
goto LABEL_47;
}
v26 = v3 - v23;
v27 = (INT64 *)((char *)a1 + v23);
if( *(_DWORD *)((char *)a1 + v23) != 3 || v26 < 0x2E )
goto LABEL_10;
v28 = *((unsigned int *)v27 + 5);
v29 = v26 - v28;
v30 = *(_DWORD *)((char *)v27 + v28);
if( v30 == 2 )
{
if( v29 < 0x16 )
goto LABEL_10;
PartitionVhdFilePath = BiGetPartitionVhdFilePath((WCHAR *)((char *)v27 + v28 + 20));
if( PartitionVhdFilePath )
{
ExFreePoolWithTag(PartitionVhdFilePath, 0x4B444342u);
LABEL_11:
v12 = -1073741637;
goto LABEL_7;
}
}
else if( v30 != 6 && (v30 != 8 || v29 < 0x22) && (v30 != 1 || v29 < 0x14) )
{
goto LABEL_10;
}
v12 = BiConvertNtDeviceToBootEnvironment(v27, v26, 0i64, &Src);
if( v12 >= 0 )
{
v25 = 10;
v24 = *((_DWORD *)Src + 2) + 70;
goto LABEL_40;
}
LABEL_7:
if( Src )
ExFreePoolWithTag(Src, 0x4B444342u);
LABEL_9:
result = (unsigned int)v12;
*v5 = v8;
return result;
}Referenced by:
BiConvertElementToRegistryData
BiConvertNtDeviceToBootEnvironment
BiConvertNtFilePathToBootEnvironment
BiCreatePartitionDevice