ExpRegisterFirmwareTableInformationHandler
NTSTATUS __stdcall ExpRegisterFirmwareTableInformationHandler(
VOID *SystemInformation,
UINT64 SystemInformationLength,
INT8 PreviousMode){
NTSTATUS v3;
_ETHREAD *CurrentThread;
char *v6;
char *v7;
VOID **PoolWithTag;
void *v9;
_QWORD *v10;
_QWORD *v11;
__int64 v13;
char **v14;
v3 = 0;
if( PreviousMode )
return -1073741727;
if( !SystemInformation || (unsigned int)SystemInformationLength < 0x18 )
return -1073741820;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)&ExBootDevicesRemovedEvent + 928, 1, PreviousMode);
v6 = (char *)(*(&ExBootDevicesRemovedEvent + 130) - 24i64);
if( (_UNKNOWN *)((char *)&ExBootDevicesRemovedEvent + 1040) != (_UNKNOWN *)*(&ExBootDevicesRemovedEvent + 130) )
{
while( *(_DWORD *)v6 != *(_DWORD *)SystemInformation )
{
v7 = (char *)*((_QWORD *)v6 + 3);
v6 = v7 - 24;
if( (char *)&ExBootDevicesRemovedEvent + 1040 == v7 )
goto LABEL_7;
}
if( *((_BYTE *)SystemInformation + 4) )
{
v3 = 0x40000000;
goto LABEL_11;
}
if( *((_QWORD *)v6 + 2) == *((_QWORD *)SystemInformation + 2) )
{
v13 = *((_QWORD *)v6 + 3);
if( *(char **)(v13 + 8) == v6 + 24 )
{
v14 = (char **)*((_QWORD *)v6 + 4);
if( *v14 == v6 + 24 )
{
*v14 = (char *)v13;
*(_QWORD *)(v13 + 8) = v14;
HalPutDmaAdapter(*((PADAPTER_OBJECT *)v6 + 2));
ExFreePoolWithTag(v6, 0x54465241u);
goto LABEL_11;
}
}
LABEL_21:
__fastfail(3u);
}
LABEL_22:
v3 = -1073741811;
goto LABEL_11;
}
LABEL_7:
if( !*((_BYTE *)SystemInformation + 4) )
goto LABEL_22;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1413894721i64);
if( PoolWithTag )
{
*(_DWORD *)PoolWithTag = *(_DWORD *)SystemInformation;
PoolWithTag[1] = (VOID *)*((_QWORD *)SystemInformation + 1);
v9 = (void *)*((_QWORD *)SystemInformation + 2);
v10 = PoolWithTag + 3;
PoolWithTag[4] = PoolWithTag + 3;
PoolWithTag[3] = PoolWithTag + 3;
PoolWithTag[2] = v9;
ObfReferenceObject(v9);
v11 = (_QWORD *)*(&ExBootDevicesRemovedEvent + 131);
if( (_UNKNOWN *)**(&ExBootDevicesRemovedEvent + 131) != (_UNKNOWN *)((char *)&ExBootDevicesRemovedEvent + 1040) )
goto LABEL_21;
*v10 = (char *)&ExBootDevicesRemovedEvent + 1040;
v10[1] = v11;
*v11 = v10;
*(&ExBootDevicesRemovedEvent + 131) = v10;
}
else
{
v3 = -1073741670;
}
LABEL_11:
ExReleaseResourceLite((PERESOURCE)((char *)&ExBootDevicesRemovedEvent + 928));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
return v3;
}Referenced by:
NtSetSystemInformation