EmInitSystem

NTSTATUS __stdcall EmInitSystem(UINT64 Phase, _LOADER_PARAMETER_BLOCK *LoaderBlock){
  VOID **PoolWithTag; 
  VOID **v3; 
  int v4; 
  NTSTATUS v5; 
  unsigned int v6; 
  unsigned int v7; 
  NTSTATUS i; 
  _LOADER_PARAMETER_EXTENSION *Extension; 
  void *EmInfFileImage; 
  UINT64 EmInfFileSize; 
  ULONG v13; 
  VOID **v14; 
  VOID **v15; 
  VOID **v16; 
  _UNICODE_STRING *Class; 
  _UNICODE_STRING *Classa; 
  _UNICODE_STRING *Classb; 
  UINT64 CreateOptions; 
  UINT64 CreateOptionsa; 
  UINT64 *Disposition; 
  UINT64 CreateDisposition; 
  UINT64 v24; 
  UINT64 EaLength; 
  UINT64 ResultLength; 
  VOID *Handle; 
  VOID *DestinationString[3]; 
  _STRING Destination; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 FileInformation; 
  __int64 v33; 
  char v34; 

  LODWORD(ResultLength) = 0;
  v33 = 0i64;
  PoolWithTag = 0i64;
  DestinationString[0] = (VOID *)-1i64;
  v3 = 0i64;
  Handle = (VOID *)-1i64;
  FileInformation = 0i64;
  Destination = 0i64;
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  *(_OWORD *)&DestinationString[1] = 0i64;
  if( !(_DWORD)Phase )
  {
    dword_140C47698 |= 0x80000000;
    EmpRuleUpdateWorker.WorkerRoutine = (void(__fastcall *)(void *))EmpRuleUpdateWorkerThread;
    EmpParseLock._bf_0 = 0i64;
    EmpDatabaseLock._bf_0 = 0i64;
    EmpEvaluationQueueLock._bf_0 = 0i64;
    EmpPagingLock._bf_0 = 0i64;
    EmpEntryListHead = 0i64;
    EmpCallbackListHead = 0i64;
    EmpRuleListHead = 0i64;
    EmpTargetRuleListHead = 0i64;
    EmpRuleUpdateQueue = 0i64;
    EmpWorkerBusy = 0;
    EmpRuleUpdateWorker.Parameter = 0i64;
    EmpRuleUpdateWorker.List.Flink = 0i64;
    Extension = LoaderBlock->Extension;
    qword_140C50898 = 0i64;
    dword_140C50890 = 0;
    dword_140C50894 = 0;
    EmInfFileImage = Extension->EmInfFileImage;
    dword_140C50884 = 0;
    dword_140C50888 = 0;
    dword_140C5088C = 0;
    if( EmInfFileImage )
    {
      EmInfFileSize = Extension->EmInfFileSize;
      if( (_DWORD)EmInfFileSize )
      {
        v4 = EmpParseInfDatabase(EmInfFileImage, EmInfFileSize);
        if( v4 < 0 )
          goto LABEL_11;
      }
    }
    EmpCacheBiosDate();
    HalRegisterErrataCallbacks();
    LODWORD(Class) = 6;
    v4 = EmpProviderRegister(
           0i64,
           0i64,
           0i64,
           (INT64)&BuiltinCallbackReg,
           (UINT64)Class,
           (UINT64 *)&EmBuiltinProviderHandle);
    if( v4 < 0 )
      goto LABEL_11;
LABEL_10:
    v4 = 0;
    goto LABEL_11;
  }
  if( (_DWORD)Phase != 1 )
    goto LABEL_10;
  RtlInitUnicodeString(
    (PUNICODE_STRING)&DestinationString[1],
    L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Errata\\Dynamic");
  LODWORD(CreateOptions) = 0;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)&DestinationString[1];
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwCreateKey(DestinationString, 0x20019ui64, &ObjectAttributes, 0i64, 0i64, CreateOptions, 0i64);
  if( v4 < 0 )
    goto LABEL_11;
  v5 = ZwQueryKey(DestinationString[0], KeyFullInformation, 0i64, 0i64, &ResultLength);
  v4 = v5;
  if( v5 == -1073741789 || v5 == -2147483643 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)ResultLength, 1953058117i64);
    if( !PoolWithTag )
      goto LABEL_29;
    v4 = ZwQueryKey(DestinationString[0], KeyFullInformation, PoolWithTag, (unsigned int)ResultLength, &ResultLength);
    if( v4 < 0 )
      goto LABEL_11;
    v6 = *((_DWORD *)PoolWithTag + 10) + 16;
    v3 = ExAllocatePoolWithTag(1ui64, v6, 1953058117i64);
    if( !v3 )
    {
LABEL_29:
      v4 = -1073741670;
      goto LABEL_11;
    }
    LODWORD(Classa) = v6;
    v7 = 0;
    for( i = ZwEnumerateValueKey(
                DestinationString[0],
                0i64,
                KeyValuePartialInformation,
                v3,
                (UINT64)Classa,
                &ResultLength);
          ;
          i = ZwEnumerateValueKey(
                DestinationString[0],
                v7,
                KeyValuePartialInformation,
                v3,
                (UINT64)Classb,
                &ResultLength) )
    {
      v4 = i;
      if( i == -2147483622 )
        break;
      if( i < 0 )
        goto LABEL_11;
      *(_DWORD *)&Destination.Length = 0x1000000;
      Destination.Buffer = &v34;
      RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], L"\\SystemRoot\\inf\\");
      RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString[1]);
      *((_BYTE *)v3 + *((unsigned int *)v3 + 2) + 12) = 0;
      RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[1], (PCWSTR)v3 + 6);
      RtlAppendStringToString(&Destination, (const _STRING *)&DestinationString[1]);
      LODWORD(EaLength) = 0;
      LODWORD(v24) = 32;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)&Destination;
      ObjectAttributes.Length = 48;
      LODWORD(CreateDisposition) = 1;
      LODWORD(Disposition) = 1;
      LODWORD(CreateOptionsa) = 128;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v4 = ZwCreateFile(
             &Handle,
             0x120089ui64,
             &ObjectAttributes,
             &IoStatusBlock,
             0i64,
             CreateOptionsa,
             (UINT64)Disposition,
             CreateDisposition,
             v24,
             0i64,
             EaLength);
      if( v4 < 0 )
        goto LABEL_11;
      v4 = ZwQueryInformationFile(Handle, &IoStatusBlock, &FileInformation, 0x18ui64, FileStandardInformation);
      if( v4 < 0 )
      {
        ZwClose((_HANDLE)Handle);
        goto LABEL_11;
      }
      if( HIDWORD(FileInformation) )
      {
        ZwClose((_HANDLE)Handle);
        goto LABEL_27;
      }
      v13 = DWORD2(FileInformation);
      v14 = ExAllocatePoolWithTag(1ui64, DWORD2(FileInformation), 1953058117i64);
      v15 = v14;
      if( !v14 )
      {
        ZwClose((_HANDLE)Handle);
        goto LABEL_29;
      }
      v4 = ZwReadFile((_HANDLE)Handle, 0, 0i64, 0i64, &IoStatusBlock, v14, v13, 0i64, 0i64);
      ZwClose((_HANDLE)Handle);
      v16 = v15;
      if( v4 < 0 )
        goto LABEL_39;
      v4 = EmpParseInfDatabase(v15, v13);
      if( v4 < 0 )
      {
        v16 = v15;
LABEL_39:
        ExFreePoolWithTag(v16, 0x74694D45u);
        goto LABEL_11;
      }
      ++v7;
      LODWORD(Classb) = v6;
    }
    goto LABEL_10;
  }
  if( !v5 )
LABEL_27:
    v4 = -1073741823;
LABEL_11:
  if( DestinationString[0] != (VOID *)-1i64 )
    ZwClose((_HANDLE)DestinationString[0]);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x74694D45u);
  if( v3 )
    ExFreePoolWithTag(v3, 0x74694D45u);
  return v4;
}

Referenced by:

Phase1InitializationIoReady