MiProcessLoaderEntry

VOID __stdcall MiProcessLoaderEntry(_KLDR_DATA_TABLE_ENTRY *DataTableEntry, UINT64 Insert){
  INT64 v2; 
  _ETHREAD *CurrentThread; 
  int v4; 
  _LIST_ENTRY *v6; 
  BOOL v7; 
  _QWORD *v8; 
  void *DllBase; 
  unsigned __int64 v10; 
  _QWORD *v11; 
  _LIST_ENTRY *Flink; 
  _LIST_ENTRY *Blink; 
  UINT8 OldIrql; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = Insert;
  OldIrql = 0;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite((UINT64)&PsLoadedModuleResource, 1, v2);
  if( v4 != 1 )
  {
    if( (MiFlags & 0x80000) == 0 )
      RtlRemoveInvertedFunctionTable(DataTableEntry->DllBase);
    MmLockLoadedModuleListExclusive(&OldIrql);
    Flink = DataTableEntry->InLoadOrderLinks.Flink;
    Blink = DataTableEntry->InLoadOrderLinks.Blink;
    if( (_KLDR_DATA_TABLE_ENTRY *)DataTableEntry->InLoadOrderLinks.Flink->Blink == DataTableEntry
      && (_KLDR_DATA_TABLE_ENTRY *)Blink->Flink == DataTableEntry )
    {
      Blink->Flink = Flink;
      Flink->Blink = Blink;
      RtlAvlRemoveNode((UINT64 *)&BugCheckParameter3, (INT64 *)&DataTableEntry[1].FullDllName);
      ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
      __writecr8(OldIrql);
      goto LABEL_12;
    }
LABEL_20:
    __fastfail(3u);
  }
  MmLockLoadedModuleListExclusive(&OldIrql);
  v6 = (_LIST_ENTRY *)*(&PsLoadedModuleList + 1);
  if( *(INT64 **)*(&PsLoadedModuleList + 1) != &PsLoadedModuleList )
    goto LABEL_20;
  DataTableEntry->InLoadOrderLinks.Flink = (_LIST_ENTRY *)&PsLoadedModuleList;
  v7 = 0;
  DataTableEntry->InLoadOrderLinks.Blink = v6;
  v6->Flink = &DataTableEntry->InLoadOrderLinks;
  v8 = BugCheckParameter3;
  *(&PsLoadedModuleList + 1) = (INT64)DataTableEntry;
  DllBase = DataTableEntry->DllBase;
  if( BugCheckParameter3 )
  {
    while( 1 )
    {
      v10 = *(v8 - 23);
      if( (unsigned __int64)DllBase <= v10 + (unsigned int)(*((_DWORD *)v8 - 42) - 1) )
      {
        if( (unsigned __int64)DllBase >= v10 )
          KeBugCheckEx(0x1Au, (PVOID)0x2101, DllBase, v8, 0i64);
        v11 = (_QWORD *)*v8;
        if( !*v8 )
        {
          v7 = 0;
          break;
        }
      }
      else
      {
        v11 = (_QWORD *)v8[1];
        if( !v11 )
        {
          v7 = 1;
          break;
        }
      }
      v8 = v11;
    }
  }
  RtlAvlInsertNodeEx(
    (_RTL_BALANCED_NODE **)&BugCheckParameter3,
    (UINT64)v8,
    v7,
    (_RTL_BALANCED_NODE *)&DataTableEntry[1].FullDllName);
  ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
  __writecr8(OldIrql);
  if( (MiFlags & 0x80000) == 0 )
    RtlInsertInvertedFunctionTable(DataTableEntry->DllBase, DataTableEntry->SizeOfImage);
LABEL_12:
  MiReleaseResourceLite(&CurrentThread->Tcb);
}

Referenced by: