MiRememberUnloadedDriver

VOID __stdcall MiRememberUnloadedDriver(const VOID **DriverName, VOID *Address, UINT64 Length){
  __int64 v3; 
  _ETHREAD *CurrentThread; 
  char *v7; 
  __int64 v8; 
  _UNICODE_STRING *v9; 
  wchar_t *Pool; 

  v3 = (unsigned int)Length;
  if( *(_WORD *)DriverName )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquireResourceExclusiveLite((UINT64)&PsLoadedModuleResource, 1, Length);
    v7 = (char *)MmUnloadedDrivers;
    if( MmUnloadedDrivers )
    {
      v8 = (unsigned int)MmLastUnloadedDriver;
      if( (unsigned int)MmLastUnloadedDriver < 0x32 )
        goto LABEL_4;
    }
    else
    {
      MmUnloadedDrivers = MiAllocatePool(64i64, 0x7D0ui64, 0x54446D4Dui64);
      v7 = (char *)MmUnloadedDrivers;
      if( !MmUnloadedDrivers )
      {
LABEL_6:
        MiReleaseResourceLite(&CurrentThread->Tcb);
        return;
      }
    }
    v8 = 0i64;
    MmLastUnloadedDriver = 0;
LABEL_4:
    v9 = (_UNICODE_STRING *)&v7[40 * v8];
    RtlFreeAnsiString(v9);
    Pool = (wchar_t *)MiAllocatePool(64i64, *(unsigned __int16 *)DriverName, 0x54446D4Dui64);
    v9->Buffer = Pool;
    if( Pool )
    {
      memmove(Pool, DriverName[1], *(unsigned __int16 *)DriverName);
      v9->Length = *(_WORD *)DriverName;
      v9->MaximumLength = *((_WORD *)DriverName + 1);
      v9[1].Buffer = (wchar_t *)((char *)Address + v3);
      *(_QWORD *)&v9[1].Length = Address;
      *(_QWORD *)&v9[2].Length = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
      ++MmLastUnloadedDriver;
    }
    else
    {
      *(_DWORD *)&v9->Length = 0;
    }
    goto LABEL_6;
  }
}

Referenced by: