ExRegisterBootDevice

BOOL __fastcall ExRegisterBootDevice(WCHAR *a1, INT64 a2, INT64 a3, UINT64 *a4){
  NTSTATUS v6; 
  char *PoolWithTag; 
  void *v8; 
  UINT64 v9; 
  unsigned __int8 v10; 
  unsigned __int64 v11; 
  _QWORD *v12; 
  _QWORD *v13; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *ThreadHandle; 
  PVOID Object; 
  ThreadHandle = 0i64;
  v6 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  KeWaitForSingleObject(&ExExternalBootSupportInitializationEvent, Executive, 0, 0, 0i64);
  if( !ExBootDeviceRemovalHandler )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 512;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v6 = PsCreateSystemThread(&ThreadHandle, 0, &ObjectAttributes, 0i64, 0i64, ExpWaitForBootDevices, 0i64);
    if( v6 >= 0 )
    {
      Object = 0i64;
      v6 = ObReferenceObjectByHandle(ThreadHandle, 0x1FFFFFu, 0i64, 0, &Object, 0i64);
      ExBootDeviceRemovalHandler = (PKTHREAD)Object;
      ZwClose(ThreadHandle);
      KeSetPriorityThread(ExBootDeviceRemovalHandler, 31);
    }
  }
  KeSetEvent(&ExExternalBootSupportInitializationEvent, 0);
  if( v6 >= 0 )
  {
    if( *(_DWORD *)a1 != 1 || !*((_QWORD *)a1 + 1) || *((_DWORD *)a1 + 1) || !*((_QWORD *)a1 + 3) )
      v6 = -1073741811;
    if( v6 >= 0 )
    {
      PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x40ui64, 0x504E4442ui64);
      if( !PoolWithTag )
        v6 = -1073741670;
      if( v6 >= 0 )
      {
        ObfReferenceObjectWithTag(*((PVOID *)a1 + 1), 0x746C6644u);
        v8 = (void *)*((_QWORD *)a1 + 2);
        if( v8 )
          ObfReferenceObjectWithTag(v8, 0x746C6644u);
        memset((INT64)PoolWithTag, 0i64);
        *(_DWORD *)PoolWithTag = 1347306562;
        *(_OWORD *)(PoolWithTag + 24) = *(_OWORD *)a1;
        *(_OWORD *)(PoolWithTag + 40) = *((_OWORD *)a1 + 1);
        *((_QWORD *)PoolWithTag + 7) = *((_QWORD *)a1 + 4);
        KeAcquireSpinLockRaiseToDpc(&ExBootDeviceListSpinLock, v9);
        v11 = v10;
        v12 = (_QWORD *)qword_140C191D8;
        v13 = PoolWithTag + 8;
        if( *(__int64 **)qword_140C191D8 != &ExBootDeviceList )
          __fastfail(3u);
        *v13 = &ExBootDeviceList;
        *((_QWORD *)PoolWithTag + 2) = v12;
        *v12 = v13;
        qword_140C191D8 = (__int64)(PoolWithTag + 8);
        KxReleaseSpinLock(&ExBootDeviceListSpinLock);
        __writecr8(v11);
        *(_QWORD *)a2 = PoolWithTag;
      }
    }
  }
  return v6;
}

Referenced by: