MiApplyHotPatchToLoadedDriver

NTSTATUS __fastcall MiApplyHotPatchToLoadedDriver(UINT64 BlockId, _UNICODE_STRING *ImageFileName, UINT64 LoadFlags){
  VOID *v3; 
  unsigned int v7; 
  _MMPTE *PteAddress; 
  unsigned int v9; 
  _MMPTE *v10; 
  NTSTATUS result; 
  UINT64 v12; 
  void *v13; 
  _SECTION *v14; 
  _CONTROL_AREA *v15; 
  unsigned int TotalNumberOfPtes; 
  _SECTION *v17; 
  VOID *SystemAddressForImage; 
  int active; 
  NTSTATUS v20; 
  _CONTROL_AREA *v21; 
  int v22; 
  int v23; 
  VOID *v24; 
  UINT64 v25; 
  _GUID **BaseDirectory; 
  _UNICODE_STRING *BaseDirectorya; 
  _GUID *ApplicationId; 
  _KLDR_DATA_TABLE_ENTRY *NewDataTableEntry; 
  _UNICODE_STRING PrefixedImageName; 
  _UNICODE_STRING BaseName; 
  _UNICODE_STRING v32; 
  UINT64 SharePages; 
  _UNICODE_STRING *ImageFileNamea; 
  unsigned int v35; 

  ImageFileNamea = ImageFileName;
  v3 = *(VOID **)(BlockId + 48);
  ApplicationId = 0i64;
  NewDataTableEntry = 0i64;
  LODWORD(SharePages) = 0;
  v7 = 0;
  BaseName = 0i64;
  v32 = 0i64;
  PrefixedImageName = 0i64;
  if( MI_IS_PHYSICAL_ADDRESS(v3) )
  {
    PteAddress = MiGetPteAddress(v3);
    v10 = &PteAddress[((v9 >> 12) + ((v9 & 0xFFF) != 0) + 511i64) & 0xFFFFFFFFFFFFFE00ui64];
    if( !MiMakeZeroedPageTables(
            v10,
            &v10[((unsigned int)dword_140C4C9F0 >> 12) - 1 + ((dword_140C4C9F0 & 0xFFF) != 0)],
            0i64,
            MiVaDriverImages) )
      return -1073741670;
  }
  result = MiGenerateSystemImageNames(ImageFileName, 0i64, 0i64, &BaseName, &v32, &PrefixedImageName);
  if( result >= 0 )
  {
    BaseDirectory = &ApplicationId;
    result = MiObtainSectionForDriver(
               &PrefixedImageName,
               ImageFileName,
               LoadFlags,
               (_KLDR_DATA_TABLE_ENTRY **)0x40000000);
    if( result == 272 )
    {
      if( (*(_DWORD *)&ApplicationId[12].Data2 & 0x20) == 0 )
        return 272;
      if( *(_QWORD *)ApplicationId[17].Data4 == BlockId )
        return MiApplyDriverHotPatch(ApplicationId, BlockId, ApplicationId, v12, (INT64)&ApplicationId);
      return -1073741791;
    }
    if( result < 0 )
      return result;
    v13 = ApplicationId;
    v14 = *(_SECTION **)&ApplicationId[7].Data1;
    if( !v14 )
    {
      ExFreePoolWithTag(ApplicationId, 0);
      return -1073741792;
    }
    v15 = MiSectionControlArea(*(_SECTION **)&ApplicationId[7].Data1);
    TotalNumberOfPtes = v15->Segment->TotalNumberOfPtes;
    *((_DWORD *)v13 + 16) = TotalNumberOfPtes << 12;
    v35 = TotalNumberOfPtes;
    SystemAddressForImage = MiGetSystemAddressForImage(v17, 0i64, &SharePages);
    if( !SystemAddressForImage )
    {
      ObDereferenceObjectDeferDelete((UINT64)v14);
      ExFreePoolWithTag(v13, 0);
      return -1073741670;
    }
    MiCheckPurgeAndUpMapCount(v15);
    *((_QWORD *)v13 + 6) = SystemAddressForImage;
    v20 = MiControlAreaRequiresCharge((INT64)v15);
    if( !v20 )
    {
      active = -1073740277;
      goto LABEL_18;
    }
    if( v20 == 2 )
    {
      active = MiReferenceActiveSubsection((_SUBSECTION *)&v15[1], 0x88ui64, 0x11u);
      if( active < 0 )
      {
        v20 = 1;
LABEL_18:
        if( v13 )
        {
          if( v20 == 2 && (v7 & 4) == 0 )
          {
            v21 = MiSectionControlArea(*((_SECTION **)v13 + 14));
            MiReturnCrossPartitionControlAreaCharges((INT64)v21);
          }
          MiUnloadSystemImage(v13, v7);
        }
        return active;
      }
    }
    MiMapSystemImage(v14, SystemAddressForImage, 0i64);
    active = v22;
    if( v22 < 0 )
      goto LABEL_18;
    _InterlockedExchangeAdd((_DWORD *)&stru_140C4DB30 + 1144, v35);
    v13 = ApplicationId;
    v23 = SharePages;
    LODWORD(BaseDirectory) = SharePages;
    v7 = 1;
    active = MiConstructLoaderEntry(
               (_KLDR_DATA_TABLE_ENTRY *)ApplicationId,
               &BaseName,
               &PrefixedImageName,
               0i64,
               (UINT64)BaseDirectory,
               &NewDataTableEntry);
    if( active < 0 )
      goto LABEL_18;
    ExFreePoolWithTag(v13, 0);
    v13 = NewDataTableEntry;
    v7 = 5;
    if( v20 == 2 )
      HIDWORD(NewDataTableEntry[1].GpValue) |= 0x80u;
    active = VslPrepareDriverForPatch(*(_QWORD *)(BlockId + 48));
    if( active < 0 )
      goto LABEL_18;
    if( !v23 )
      MiBackSingleImageWithPagefile((_KLDR_DATA_TABLE_ENTRY *)v13);
    active = MiHandleDriverNonPagedSections((_KLDR_DATA_TABLE_ENTRY *)v13, 0i64, 1ui64);
    if( active < 0 )
      goto LABEL_18;
    active = MiApplyDriverHotPatch((const _GUID *)v13, BlockId, v24, v25, (INT64)BaseDirectorya);
    if( active < 0 )
      goto LABEL_18;
    if( (MiFlags & 0x80000) != 0 )
      *((_DWORD *)v13 + 26) |= 0x2100u;
    MiDriverLoadSucceeded(
      (_KLDR_DATA_TABLE_ENTRY *)v13,
      v14,
      ImageFileNamea,
      &PrefixedImageName,
      &BaseName,
      1u,
      (UINT64)ApplicationId);
    return 0;
  }
  return result;
}

Referenced by: