NtDeleteDriverEntry

NTSTATUS __stdcall NtDeleteDriverEntry(UINT64 Id){
  unsigned int v1; 
  char PreviousMode; 
  _ETHREAD *CurrentThread; 
  NTSTATUS EnvironmentVariable; 
  UINT64 Attributes; 
  UINT64 ValueLength; 
  WCHAR Dst[12]; 

  v1 = Id;
  if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
    return -1073741822;
  if( (unsigned int)Id > 0xFFFF )
    return -1073741811;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
    return -1073741727;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
  swprintf_s(Dst, 0xBui64, (WCHAR *)L"Driver%04X", v1);
  LODWORD(ValueLength) = 0;
  EnvironmentVariable = IoGetEnvironmentVariableEx(Dst, (_GUID *)&EfiDriverVariablesGuid, 0i64, &ValueLength, 0i64);
  if( EnvironmentVariable != -1073741568 )
    goto LABEL_11;
  if( ((2 * ((v1 | (2 * v1)) & 0xC4444444)) & v1) != 0 )
  {
    swprintf_s(Dst, 0xBui64, (WCHAR *)L"Driver%04x", v1);
    LODWORD(ValueLength) = 0;
    EnvironmentVariable = IoGetEnvironmentVariableEx(Dst, (_GUID *)&EfiDriverVariablesGuid, 0i64, &ValueLength, 0i64);
LABEL_11:
    if( !EnvironmentVariable || EnvironmentVariable == -1073741789 )
    {
      LODWORD(Attributes) = 1;
      EnvironmentVariable = IoSetEnvironmentVariableEx(Dst, (_GUID *)&EfiDriverVariablesGuid, 0i64, 0i64, Attributes);
    }
  }
  ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return EnvironmentVariable;
}

Referenced by: