MmWriteSystemImageTracepoint

NTSTATUS __fastcall MmWriteSystemImageTracepoint(UINT64 ControlPc, CHAR a2, CHAR a3){
  CHAR v3; 
  INT8 v5; 
  INT64 v6; 
  _ETHREAD *Lock; 
  _LIST_ENTRY *v8; 
  INT64 v9; 
  int v10; 
  char v11; 
  VOID *v12; 
  unsigned int v13; 
  ULONG BeginAddress; 
  _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *v15; 
  ULONG v16; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  UINT64 v18; 
  UINT64 v19; 
  CHAR v20; 
  UINT64 ImageBase; 
  INT64 v25[8]; 
  INT64 v26[14]; 

  v3 = a2;
  memset(v25, 0i64, sizeof(v25));
  ImageBase = 0i64;
  Lock = MmAcquireLoadLock(v6, v5);
  v8 = MiLookupDataTableEntry((VOID *)ControlPc, 0i64);
  v9 = (INT64)v8;
  if( v8 )
  {
    if( MiGetSystemRegionType((UINT64)v8[3].Flink) == 1 )
    {
      v10 = -1073741637;
    }
    else
    {
      v11 = 0;
      MiInitializeDriverPatchState(v9, (INT64)v25);
      v10 = MiPrepareDriverPatchState((INT64)v25);
      if( v10 >= 0 )
      {
        while( 1 )
        {
          if( v11 )
          {
            v13 = *(_DWORD *)(v9 + 64);
            BeginAddress = 0;
          }
          else if( v3 )
          {
            v15 = RtlLookupFunctionEntry(ControlPc, &ImageBase, 0i64);
            if( !v15 )
              break;
            BeginAddress = v15->BeginAddress;
            v13 = v15->UnwindData - v15->BeginAddress;
          }
          else
          {
            v13 = 1;
            BeginAddress = ControlPc - *(_DWORD *)(v9 + 48);
          }
          if( !v13 )
            break;
          v16 = *(_DWORD *)(v9 + 64);
          if( BeginAddress >= v16 || v16 - BeginAddress < v13 )
            break;
          AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v12);
          v10 = MiLockDriverPageRange(v25, (INT64)AnyMultiplexedVm, v18, v19, v20, 0i64);
          if( v10 < 0 )
            goto LABEL_22;
          memset(v26, 0i64, 0x68u);
          LOBYTE(v26[3]) = a3;
          v26[1] = ControlPc;
          v26[2] = __PAIR64__(v13, BeginAddress);
          v10 = VslpEnterIumSecureMode(2u, 77, 0i64, (INT64)v26);
          if( v10 != -1073741267 )
            goto LABEL_22;
          if( v11 )
          {
            v10 = -1073741637;
            goto LABEL_22;
          }
          MiUnlockDriverPages((UINT64 *)v25);
          v11 = 1;
          MiInitializeDriverPatchState(v9, (INT64)v25);
          v10 = MiPrepareDriverPatchState((INT64)v25);
          if( v10 < 0 )
            goto LABEL_22;
          v3 = a2;
        }
        v10 = -1073741811;
      }
LABEL_22:
      MiUnlockDriverPages((UINT64 *)v25);
    }
  }
  else
  {
    v10 = -1073741811;
  }
  if( Lock )
    MmReleaseLoadLock(Lock);
  return v10;
}

Referenced by: