PopBootStatCheckIntegrity

INT64 __fastcall PopBootStatCheckIntegrity(INT64 a1){
  UINT8 *PoolWithTag; 
  CHAR v3; 
  INT16 v4; 
  int v5; 
  UINT64 v6; 
  UINT64 v7; 
  __int64 i; 
  _ETHREAD *CurrentThread; 
  void *FileHandle; 
  UINT8 *v12; 
  ULONGLONG pullResult; 
  UINT8 *v14; 
  char v15; 
  pullResult = 0i64;
  PoolWithTag = 0i64;
  FileHandle = 0i64;
  v15 = 0;
  v3 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v3 )
  {
    v5 = RtlULongLongMult(*(unsigned int *)(a1 + 8), 0x18ui64, &pullResult);
    if( v5 < 0 )
      goto LABEL_23;
    v6 = pullResult;
    PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, pullResult, 0x206D654Dui64);
    v12 = PoolWithTag;
    if( !PoolWithTag )
    {
      v5 = -1073741670;
      goto LABEL_23;
    }
    if( v6 )
    {
      v7 = *(_QWORD *)(a1 + 16);
      if( (v7 & 7) != 0 )
        ExRaiseDatatypeMisalignment();
      if( v7 + v6 > 0x7FFFFFFF0000i64 || v7 + v6 < v7 )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
    memmove(PoolWithTag, *(UINT8 **)(a1 + 16), v6);
    for( i = 0i64; (unsigned int)i < *(_DWORD *)(a1 + 8); i = (unsigned int)(i + 1) )
    {
      v14 = &PoolWithTag[24 * i];
      ProbeForWrite(*((VOID **)v14 + 1), *((unsigned int *)v14 + 4), 1ui64);
    }
  }
  else
  {
    PoolWithTag = *(UINT8 **)(a1 + 16);
    v12 = PoolWithTag;
  }
  v15 = 1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&PopBootStatLock, 0i64);
  v5 = RtlLockBootStatusData(&FileHandle);
  if( v5 >= 0 )
  {
    if( !v3 || (v5 = PopBootStatAccessCheck(FileHandle, v3, 1ui64), v5 >= 0) )
    {
      v5 = RtlCheckBootStatusIntegrity(FileHandle);
      if( v5 >= 0 )
      {
        if( *((_DWORD *)PoolWithTag + 4) )
          **((_BYTE **)PoolWithTag + 1) = 0;
        else
          v5 = -1073741811;
      }
    }
  }
LABEL_23:
  if( FileHandle )
    RtlUnlockBootStatusData(FileHandle, v4);
  if( v15 )
  {
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&PopBootStatLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)&PopBootStatLock);
    KeAbPostRelease(&PopBootStatLock);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  }
  if( v3 && PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return(unsigned int)v5;
}

Referenced by: