Status = gRT->GetVariable (
                L"ExampleConfiguration",                // VariableName
                &gEfiExampleConfigurationVariableGuid,  // VendorGuid
                &Attributes,                            // Attributes
                &DataSize,                              // DataSize
                &ExampleConfiguration                   // Data
                );

Status = gRT->SetVariable (
                L"ExampleConfiguration",               // VariableName
                &gEfiExampleConfigurationVariableGuid, // VendorGuid
                EFI_VARIABLE_NON_VOLATILE |
                EFI_VARIABLE_BOOTSERVICE_ACCESS |
                EFI_VARIABLE_RUNTIME_ACCESS,
                                                       // Attributes 
                sizeof (EXAMPLE_CONFIGURATION),        // DataSize
                &ExampleConfiguration                  // Data
                );

bool CheckBatterySafety()
{
  EFI_GUID VendorGuid;
  char Buffer;
  UINTN DataSize;

  VendorGuid.Data1 = 0xFB3B9ECE;
  *&VendorGuid.Data2 = 0x49334ABA;
  *VendorGuid.Data4 = 0xD6B49DB4;
  *&VendorGuid.Data4[4] = 0x5123897D;
  Buffer = 0;
  DataSize = 1i64;
  return (!gRT_157B30->GetVariable(L"BatterySafetyModeStatus", &VendorGuid, 0i64, &DataSize, &Buffer)
       || !gRT_157B30->GetVariable(L"BatterySafetyMode", &VendorGuid, 0i64, &DataSize, &Buffer))
      && Buffer == 1;
}

EFI_STATUS
EFIAPI
SdioSmm_SwSmi_40h(
  EFI_HANDLE  DispatchHandle,
  CONST VOID  *Context,
  VOID        *CommBuffer,
  UINTN       *CommBufferSize
  )
{
  // ...
  struct_v0 *userControlled = *(0x10 * MEMORY[0x40E] + 0x104);
  if ( EFI_ERROR(ValidateBufferIsOutsideSmram(userControlled, sizeof(struct_v0)))
    || userControlled->Offset0_FunctionCode >= 4 )
  {
    userControlled->Offset2 = 7;
  }
  else
  {
    // ...
  }
  return EFI_SUCCESS;
}

typedef struct _ssa_normal_reg {
    UINT64 r15; // start at SMBASE + 0xFF1C
    UINT64 r14; // 0xFF24
    UINT64 r13; // 0xFF2C
    UINT64 r12; // 0xFF34
    UINT64 r11; // 0xFF3C
    UINT64 r10; // 0xFF44
    UINT64 r9; // 0xFF4C
    UINT64 r8; // 0xFF54
    UINT64 rax; // 0xFF5C
    UINT64 rcx; // 0xFF64
    UINT64 rdx; // 0xFF6C
    UINT64 rbx; // 0xFF74
    UINT64 rsp; // 0xFF7C
    UINT64 rbp; // 0xFF84
    UINT64 rsi; // 0xFF8C
    UINT64 rdi; // 0xFF94
} ssa_normal_reg_t;

.text:000000000000048C SwSmiHandler_48C proc near              ; DATA XREF: sub_314+FA↑o
...
.text:000000000000048C
.text:000000000000048C                 mov     [rsp-28h+arg_0], rbx
.text:0000000000000491                 mov     [rsp-28h+arg_8], rsi
.text:0000000000000496                 mov     [rsp-28h+arg_10], rdi
.text:000000000000049B                 push    rbp
.text:000000000000049C                 push    r12
.text:000000000000049E                 push    r13
...
...
.text:0000000000000BAC ; ---------------------------------------------------------------------------
.text:0000000000000BAC
.text:0000000000000BAC loc_BAC:                                ; CODE XREF: SwSmiHandler_48C+6C2↑j
.text:0000000000000BAC                 mov     rax, cs:gRT_1B00
.text:0000000000000BB3                 xor     edx, edx        ; ResetStatus
.text:0000000000000BB5                 xor     r9d, r9d        ; ResetData
.text:0000000000000BB8                 lea     ecx, [rdx+2]    ; ResetType
.text:0000000000000BBB                 xor     r8d, r8d        ; DataSize
.text:0000000000000BBE                 call    [rax+EFI_RUNTIME_SERVICES.ResetSystem] ; gRT->ResetSystem()
...
.text:0000000000000314 sub_314         proc near               ; CODE XREF: _ModuleEntryPoint+7B↑p
...
.text:0000000000000340                 call    [rax+_EFI_SMM_SYSTEM_TABLE2.SmmLocateProtocol] ; gSmst->SmmLocateProtocol
.text:0000000000000346                 mov     rax, cs:gSmst_1AF8
.text:000000000000034D                 lea     r8, [rsp+28h+EFI_SMM_SW_DISPATCH2_PROTOCOL_IF] ; Interface
.text:0000000000000352                 lea     rcx, EFI_SMM_SW_DISPATCH2_PROTOCOL_GUID_19F0 ; Protocol
.text:0000000000000359                 xor     edx, edx        ; Registration
...
.text:00000000000003F5                 lea     r9, [rsp+28h+DispatchHandle] ; DispatchHandle
.text:00000000000003FA                 mov     rcx, [rax]
.text:00000000000003FD                 mov     rax, [rsp+28h+EFI_SMM_SW_DISPATCH2_PROTOCOL_IF]
.text:0000000000000402                 lea     r8, [rsp+28h+RegisterContext] ; RegisterContext
.text:0000000000000407                 mov     cs:qword_1C28, rcx
.text:000000000000040E                 lea     rdx, SwSmiHandler_48C ; DispatchFunction
.text:0000000000000415                 mov     rcx, rax        ; This
.text:0000000000000418                 mov     [rsp+28h+RegisterContext.SwSmiInputValue], 80h ; '€'
.text:0000000000000421                 call    [rax+EFI_SMM_SW_DISPATCH2_PROTOCOL.Register]

__int64 __fastcall SwSmiHandler_48C():

  case 0x7003u:
    gRT_1B00->ResetSystem(EfiResetShutdown, 0i64, 0i64, 0i64);
    goto LABEL_132;

// mEraseRecordShare - buffer is allocated on heap. 
// AepErrorLog - NVRAM variable is controlled by the attacker. 

Tries = 3;
DataSize = 0; 
...
  do
  {
    // overflow occurs after the second try because variable length exceeds 964 bytes
    Status = gRT->GetVariable(L"AepErrorLog", &VendorGuid, 0, &DataSize, mEraseRacordShare);
    --Tries;
    v5 = Status < 0;
  }
  while ( Status < 0 && Tries );
...

EFI_STATUS __fastcall SwSmiHandler_1574(EFI_HANDLE DispatchHandle)
{
  EFI_STATUS result;
  UINT32 Attributes;
  UINTN DataSize;
  EFI_SMM_SW_DISPATCH2_PROTOCOL *EfiSmmSwDispatch2;
  __int64 Data[6];

  Attributes = 6;
  DataSize = 32i64;
  if ( (gRT_20F8->GetVariable(L"AmdMemContextData", &VendorGuid, &Attributes, &DataSize, Data) & 0x8000000000000000ui64) == 0i64 )
    x_AmdMemContextHandler(Data);
  result = gSmst_20F0->SmmLocateProtocol(&EFI_SMM_SW_DISPATCH_PROTOCOL_GUID_2050, 0i64, &EfiSmmSwDispatch2);
  if ( (result & 0x8000000000000000ui64) == 0i64 )
    return (EfiSmmSwDispatch2->UnRegister)(EfiSmmSwDispatch2, DispatchHandle);
  return result;
}

...
_GetCoolControlData:
  DataSize = 8i64;
  vStatus = gRT_23B0->GetVariable(
              (CHAR16 *)L"CoolControlData",
              &gVendorGuid,
              (UINT32 *)&Attributes,
              &DataSize,
              vCoolControlDataValue);
  // If the length of the CoolControlData variable is greater than 8, then at the moment vStatus = EFI_BUFFER_TOO_SMALL
  // (this means that the GetVariable call will occur a second time)
  if ( !vStatus
    || (vStatus = gRT_23B0->GetVariable(
                    (CHAR16 *)L"CoolControlData",
                    &gVendorGuid,
                    (UINT32 *)&Attributes,
                    &DataSize,
                    vCoolControlDataValue)) == 0 )
  {
    LOBYTE(v19) = vCoolControlDataValue[1];
    LOBYTE(v20) = 1;
    sub_1A78(v20, v19);
  }
  return vStatus;
}

EFI_STATUS __fastcall SmiHandler_2158(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        _QWORD *CommBuffer,
        UINTN *CommBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  Num = 4;
  if ( CommBuffer && CommBufferSize && (-(__int64)(*CommBufferSize != 24) & EFI_INVALID_PARAMETER) == 0 )
  {
    Size = GetStrSize((_WORD *)CommBuffer[1]);
    CommBuffer1 = CommBuffer[1];
    Size1 = Size;
    Res = 0;
    if ( CommBuffer1 && Size1 )
      Res = SmmIsBufferOutsideSmmValid(CommBuffer1, Size1);
    if ( (-(__int64)(Res == 0) & EFI_INVALID_PARAMETER) == 0 )
    {
      if ( *(_BYTE *)CommBuffer )
      {
        if ( *(_BYTE *)CommBuffer == 1 )
        {
          if ( GetWideStrSize((_WORD *)CommBuffer[1]) )
          {
            Res1 = FactoryConfigHandler((_WORD *)CommBuffer[1], (__int64)&Num, 1);// possible heap overflow
            goto _Exit;
          }
        }
        else if ( *(_BYTE *)CommBuffer == 2 )
        {
          Res1 = BuildIdHandler((_WORD *)CommBuffer[1], (__int64)&Num, 1);// possible heap overflow
_Exit:
          CommBuffer[2] = Res1;
          return 0;
        }
      }
      else if ( GetWideStrSize((_WORD *)CommBuffer[1]) )
      {
        CommBuffer[2] = Validate((_WORD *)CommBuffer[1]) ? 0 : EFI_CRC_ERROR;
        return 0;
      }
      CommBuffer[2] = EFI_INVALID_PARAMETER;
    }
  }
  return 0;
}

Status = SmmGetVariable(L"FactoryConfig", &VariableValue);
if ( Stautus )
    goto _Exit;
if ( GetWideStrSize(StringFromCommBufferPtr) )
{
    StrSize = GetStrSize(StringFromCommBufferPtr);
    Value = VariableValue;
    if ( VariableValue && StrSize )
    {
        if ( StrSize > 500 )
        StrSize = 500;
        if ( VariableValue != StringFromCommBufferPtr )
        CopyMem(VariableValue, StringFromCommBufferPtr, StrSize);
    }
...
}

EFI_STATUS __fastcall SmiHandler_246C(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        CommBuffer *CommBuffer,
        UINTN *CommBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  if ( CommBuffer && CommBufferSize && (-(*CommBufferSize != 64) & EFI_INVALID_PARAMETER) == 0 )
  {
    Header = 'UBES';
    Error = -(CommBuffer->Header != 'UBES') & EFI_INVALID_PARAMETER;
    if ( CommBuffer->Header == 'UBES' )
    {
      if ( !CommBuffer->EnableChecks
        || !sub_40E8('UBES', Context)
        || CommBuffer->Case == 2
        || sub_324C()
        || sub_3088(CommBuffer->field_30, CommBuffer->field_28, 0i64) )
      {
        Error = 0i64;
      }
      else
      {
        Error = EFI_ACCESS_DENIED;
      }
    }
    if ( Error )
      goto _Exit;
    Case = CommBuffer->Case;
    if ( Case > 5 )
    {
      Case1 = Case - 6;
      if ( Case1 )
      {
        Case2 = Case1 - 1;
        if ( Case2 )
        {
          Case3 = Case2 - 1;
          if ( Case3 )
          {
            if ( Case3 != 1 )
            {
_Exit1:
              Error = EFI_INVALID_PARAMETER;
              goto _Exit;
            }
            // Case3 = CommBuffer->Case - 8 = 1
            // CommBuffer->Case = 9
            Res = ToCopyMemS(CommBuffer->Offset, CommBuffer->Dst, CommBuffer->DstSize);
          }
          ...
        }
        ...
      }
      ...
    }
    ...
  }
  return 0;
} 

Res = ToCopyMemS(CommBuffer->Offset, CommBuffer->Dst, CommBuffer->DstSize);

__int64 __fastcall ToCopyMemS(__int64 Offset, void *DstBuffer, unsigned int DstBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  Status = 0i64;
  if ( !DstBuffer || !DstBufferSize )
    return EFI_INVALID_PARAMETER;
  if ( gProprietaryprotocol1Located )           // Should be zero
    return (*(gProprietaryprotocol_1 + 2))(gArgs[0] + Offset);
  Func = *(gProprietaryprotocol_2 + 2);
  if ( !Func )                                  // Should be zero
  {
    CopyMemS(DstBuffer, DstBufferSize, (Offset + gArgs[0]), DstBufferSize);
    return Status;
  }
  return Func(gArgs[0] + Offset);
}

EFI_STATUS __fastcall SmiHandler_19A0(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        void *CommBuffer,
        UINTN *CommBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  ...
  // size not validated, we can allocate small buffer, then write out of bounds
  CommBufferCopy = (unsigned __int64 *)GetCopy(*CommBufferSize, CommBuffer);
  if ( CommBufferCopy )
  {
    ...
    *((_QWORD *)CommBufferCopy + 2) = Status;     // OOB write
    CopyMemS(CommBuffer, *CommBufferSize, CommBufferCopy, *CommBufferSize);
    Clear(&CommBufferCopy1, *CommBufferSize);
  }
  return 0;
}

void *__fastcall GetCopy(UINTN Size, const void *Buffer)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  result = AllocatePool(Size); // gSmst->SmmAllocatePool wrapper
  if ( result && Size && result != Buffer )
    return CopyMem(result, Buffer, Size);
  return result;
}

*((_QWORD *)CommBufferCopy + 2) = Status;     // OOB write

__int64 sub_1D38()
{
  // ...

  DataSize = 139;
  result = (gRT->GetVariable)(L"LenovoSecurityConfig", &LENOVO_SECURITY_CONFIG_VARIABLE_GUID, &DataSize, LenovoSecurityConfigValue);
  if ( (result & 0x8000000000000000) == 0 )
  {
    if...
    if ( gLenovoRuntimeConfigFlag2 | gLenovoRuntimeConfigFlag1 )
    {
      GetVariable = gRT->GetVariable;
      DataSize = 49;
      (GetVariable)(L"LenovoFunctionConfig", &gVariableGuid, &Attributes, &DataSize, LenovoFunctionConfigValue);
      LenovoFunctionConfigValue[0] = 0;
      (gRT->SetVariable)(L"LenovoFunctionConfig", &gVariableGuid, Attributes, DataSize, LenovoFunctionConfigValue);
    }
    return 0;
  }
  return result;
}

__int64 __fastcall EventNotifier()
{
  __int64 result;
  EFI_SET_VARIABLE SetVariable;
  EFI_GET_VARIABLE GetVariable;
  EFI_SET_VARIABLE SetVariable_1;
  __int64 DataSize;
  unsigned int Attributes;
  __int64 UnknownProtocolInterface;
  __int16 LenovoAbtStatusValue[7];
  char LenovoSecurityConfig[139];

  result = LocateProtocol(&gProtocolGuid, &gDataSegmentBase);
  if ( (result & 0x8000000000000000) == 0 )
  {
    DataSize = 0x8B;
    result = (gRT->GetVariable)(
               L"LenovoSecurityConfig",
               &LENOVO_SECURITY_CONFIG_VARIABLE_GUID,
               &Attributes,
               &DataSize,
               LenovoSecurityConfig);
    if ( (result & 0x8000000000000000) == 0 )
    {
      SetVariable = gRT->SetVariable;
      LenovoSecurityConfig[38] = 1;
      if ( ((SetVariable)(
              L"LenovoSecurityConfig",
              &LENOVO_SECURITY_CONFIG_VARIABLE_GUID,
              Attributes,
              DataSize,
              LenovoSecurityConfig) & 0x8000000000000000) == 0 )
        (*(UnknownProtocolInterface + 0x10))(); // aa5978d6-4fba-4827-b776-9a11fc8cce4c
      GetVariable = gRT->GetVariable;
      DataSize = 14;
      if ( ((GetVariable)(L"LenovoAbtStatus", &unk_4030, &Attributes, &DataSize, LenovoAbtStatusValue) & 0x8000000000000000) != 0 )
      {
        sub_28A8(LenovoAbtStatusValue, 14);
        LenovoAbtStatusValue[2] = 0x100;
        LenovoAbtStatusValue[0] = 1;
        sub_28A8(&LenovoAbtStatusValue[3], 7);
      }
      SetVariable_1 = gRT->SetVariable;
      LOBYTE(LenovoAbtStatusValue[2]) = 1;
      return (SetVariable_1)(L"LenovoAbtStatus", &unk_4030, Attributes, DataSize, LenovoAbtStatusValue);
    }
  }
  return result;
}

((SetVariable)(
              L"LenovoSecurityConfig",
              &LENOVO_SECURITY_CONFIG_VARIABLE_GUID,
              Attributes,
              DataSize,
              LenovoSecurityConfig) & 0x8000000000000000) == 0 )

return (SetVariable_1)(L"LenovoAbtStatus", &unk_4030, Attributes, DataSize, LenovoAbtStatusValue);

  ...
  AsciiStrToUnicodeStr(&Name, VariableName);
  StrCatS(VariableName, 0x80, L".Type");
  Flag = 0;
  if ( !(gRT->GetVariable)(VariableName, &gVariableGuid, 0, &DataSize, VariableValue) )
  {
    Flag = 1;
    dword_1E630 = VariableValue[0];
  }
  AsciiStrToUnicodeStr(&Name, VariableName);
  StrCatS(VariableName, 0x80, L".FwName");
  if ( !(gRT->GetVariable)(VariableName, &gVariableGuid, 0, &DataSize, VariableValue) )
  {
    sub_9B38(word_1E634, 0x1F, VariableValue, 0x1F);
    Flag = 1;
  }
  AsciiStrToUnicodeStr(&Name, VariableName);
  StrCatS(VariableName, 0x80, L".PartiLabel");
  if ( !(gRT->GetVariable)(VariableName, &gVariableGuid, 0, &DataSize, VariableValue) )
  {
    sub_9B38(word_1E674, 0x1F, VariableValue, 0x1F);
    Flag = 1;
  }
  AsciiStrToUnicodeStr(&Name, VariableName);
  StrCatS(VariableName, 0x80, L".PartiRootGuid");
  if ( !(gRT->GetVariable)(VariableName, &gVariableGuid, 0, &DataSize, VariableValue) )
  {
    sub_8E98(&byte_1E6B4, VariableValue);
    Flag = 1;
  }
  AsciiStrToUnicodeStr(&Name, VariableName);
  StrCatS(VariableName, 0x80, L".PartiGuid");
  if ( !(gRT->GetVariable)(VariableName, &gVariableGuid, 0, &DataSize, VariableValue) )
  {
    sub_8E98(&byte_1E6C4, VariableValue);
    Flag = 1;
  }
  AsciiStrToUnicodeStr(&Name, VariableName);
  StrCatS(VariableName, 0x80, L".ImagePath");
  if ( !(gRT->GetVariable)(VariableName, &gVariableGuid, 0, &DataSize, VariableValue) )
  {
    sub_9B38(word_1E6D4, 0x1F, VariableValue, 0x1F);
    Flag = 1;
  }
  ...