NtQueryDriverEntryOrder

NTSTATUS __stdcall NtQueryDriverEntryOrder(UINT64 *Ids, UINT64 *a2){
  NTSTATUS result; 
  INT8 v5; 
  __int64 v6; 
  unsigned int v7; 
  unsigned int v8; 
  _ETHREAD *v9; 
  NTSTATUS EnvironmentVariable; 
  unsigned int v11; 
  __int64 v12; 
  unsigned __int16 *v13; 
  _DWORD *i; 
  VOID *LockedBuffer; 
  PVOID P; 
  _ETHREAD *CurrentThread; 
  unsigned int v18; 
  LockedBuffer = 0i64;
  P = 0i64;
  if( dword_140C19650 != 2 )
    return -1073741822;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = *((_BYTE *)CurrentThread + 562);
  if( v5 )
  {
    v6 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)a2 < 0x7FFFFFFF0000i64 )
      v6 = (__int64)a2;
    *(_DWORD *)v6 = *(_DWORD *)v6;
    v7 = 4 * *(_DWORD *)a2;
    v8 = v7;
    if( !Ids )
    {
      v7 = 0;
      v8 = 0;
    }
    if( v8 )
      ProbeForWrite(Ids, v8, 4ui64);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, v5) )
      return -1073741727;
  }
  else
  {
    v7 = Ids != 0i64 ? 4 * *(_DWORD *)a2 : 0;
  }
  if( !v7 || (result = ExLockUserBuffer(Ids, v7, v5, IoWriteAccess, &LockedBuffer, &P), result >= 0) )
  {
    v18 = v7 >> 1;
    v9 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v9 + 242);
    ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
    EnvironmentVariable = HalGetEnvironmentVariableEx();
    ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( EnvironmentVariable < 0 )
    {
      if( EnvironmentVariable == -1073741568 )
      {
        v18 = 0;
        EnvironmentVariable = 0;
      }
    }
    else
    {
      v11 = v7 >> 2;
      v12 = (v7 >> 2) - 1;
      v13 = (unsigned __int16 *)((char *)LockedBuffer + 2 * v12);
      for( i = (char *)LockedBuffer + 4 * v12; v11; --v11 )
        *i-- = *v13--;
    }
    if( P )
      ExUnlockUserBuffer(P);
    *(_DWORD *)a2 = (2 * v18) >> 2;
    return EnvironmentVariable;
  }
  return result;
}

Referenced by: