MiGetProcessHotPatchContext
_QWORD *__fastcall MiGetProcessHotPatchContext(__int64 a1, int a2){
_QWORD *result;
_QWORD *Pool;
signed __int64 v5;
result = *(_QWORD **)(a1 + 2552);
if( !result )
{
if( a2 && (Pool = MiAllocatePool(64i64, 0x28ui64, 0x43505048ui64)) != 0i64 )
{
*Pool = 0i64;
Pool[1] = 0i64;
Pool[4] = Pool + 3;
Pool[3] = Pool + 3;
Pool[2] = 0i64;
v5 = _InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 2552), (signed __int64)Pool, 0i64);
if( !v5 )
return Pool;
ExFreePoolWithTag(Pool, 0);
return(_QWORD *)v5;
}
else
{
return 0i64;
}
}
return result;
}Referenced by:
MiDeleteImageHotPatchState
MiHotPatchImage
MiLogHotPatchRundown
MiQueryProcessActivePatches
MmPostHotPatchDbgModuleMessages