SiGetBiosSystemDisk

NTSTATUS __stdcall SiGetBiosSystemDisk(WCHAR **SystemDisk){
  WCHAR *v1; 
  int v3; 
  NTSTATUS v4; 
  VOID **PoolWithTag; 
  _UNICODE_STRING DestinationString; 
  UINT64 ReturnedLength; 
  VOID *ObjectHandle; 

  LODWORD(ReturnedLength) = 0;
  v1 = 0i64;
  DestinationString = 0i64;
  ObjectHandle = 0i64;
  if( !SiIsWinPeHardDiskZeroUfdBoot()
    || (v3 = SiOpenArcNameObject((WCHAR *)L"\\ArcName\\multi(0)disk(0)rdisk(1)", &ObjectHandle), v3 == -1073740718) )
  {
    v3 = SiOpenArcNameObject((WCHAR *)L"\\ArcName\\multi(0)disk(0)rdisk(0)", &ObjectHandle);
  }
  if( v3 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, 0i64);
    v4 = ZwQuerySymbolicLinkObject(ObjectHandle, &DestinationString, &ReturnedLength);
    v3 = v4;
    if( v4 == -1073741789 )
    {
      PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)ReturnedLength + 2i64, 1263556947i64);
      v1 = (WCHAR *)PoolWithTag;
      if( PoolWithTag )
      {
        DestinationString.Buffer = (wchar_t *)PoolWithTag;
        DestinationString.MaximumLength = ReturnedLength;
        v3 = ZwQuerySymbolicLinkObject(ObjectHandle, &DestinationString, 0i64);
        if( v3 >= 0 )
        {
          v1[(unsigned __int64)DestinationString.Length >> 1] = 0;
          *SystemDisk = v1;
        }
      }
      else
      {
        v3 = -1073741670;
      }
    }
    else if( v4 >= 0 )
    {
      v3 = -1073741823;
    }
  }
  if( ObjectHandle )
    ZwClose((_HANDLE)ObjectHandle);
  if( v3 < 0 && v1 )
    ExFreePoolWithTag(v1, 0);
  return v3;
}

Referenced by: