MmLoadSystemImageEx

NTSTATUS __stdcall MmLoadSystemImageEx(
        _UNICODE_STRING *ImageFileName,
        _UNICODE_STRING *NamePrefix,
        _UNICODE_STRING *LoadedBaseName,
        UINT64 LoadFlags,
        INT64 a5,
        INT64 a6){
  unsigned int v6; 
  PKINTERRUPT_ROUTINE **v10; 
  UINT32 v11; 
  PKINTERRUPT_ROUTINE *v12; 
  INT64 v13; 
  _EJOB *v14; 
  int v15; 
  NTSTATUS active; 
  INT8 v17; 
  INT64 v18; 
  unsigned int v19; 
  NTSTATUS v20; 
  char *v21; 
  _SECTION *v22; 
  _CONTROL_AREA *v23; 
  unsigned int TotalNumberOfPtes; 
  int v25; 
  UINT8 *v26; 
  _ETHREAD *v27; 
  _UNICODE_STRING *v28; 
  VOID **v29; 
  char v30; 
  NTSTATUS v31; 
  UINT64 v32; 
  VOID *v33; 
  VOID *v34; 
  _UNICODE_STRING *v35; 
  int v36; 
  UINT8 *v37; 
  INT8 *v38; 
  INT8 *v39; 
  int v40; 
  NTSTATUS inserted; 
  _CONTROL_AREA *v42; 
  VOID *PatchTableProtos; 
  __int64 v45; 
  __int64 v46; 
  unsigned int v47; 
  void *v48; 
  _FILE_OBJECT *v49; 
  __int64 v50; 
  _FILE_OBJECT *v51; 
  char v52; 
  UINT8 *v53; 
  UINT8 *v54; 
  const WCHAR *v55; 
  __int64 v56; 
  int v57; 
  UINT64 v58; 
  UINT64 v59; 
  __int64 v60; 
  WCHAR v61; 
  _UNICODE_STRING *BaseDirectory; 
  UINT64 UnloadFlags; 
  NTSTATUS v64; 
  char v65; 
  UINT64 v66; 
  _ETHREAD *CurrentThread; 
  UINT64 SharePages; 
  UINT64 LoadFlagsa; 
  UINT8 *a3; 
  PVOID P; 
  PVOID Object; 
  INT8 **v73; 
  _UNICODE_STRING BaseName; 
  _KLDR_DATA_TABLE_ENTRY *NewDataTableEntry; 
  _EJOB *PreviousSilo; 
  _UNICODE_STRING PrefixedImageName; 
  _UNICODE_STRING v78; 
  _KLDR_DATA_TABLE_ENTRY DataTableEntry; 
  UINT8 InitialLoad; 

  NewDataTableEntry = 0i64;
  v6 = LoadFlags;
  LoadFlagsa = 0i64;
  InitialLoad = 0;
  PreviousSilo = 0i64;
  v65 = 0;
  LODWORD(v66) = 1;
  LODWORD(SharePages) = 1;
  PrefixedImageName = 0i64;
  BaseName = 0i64;
  *(_QWORD *)a6 = 0i64;
  v78 = 0i64;
  if( PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)ImageFileName)->IsDownlevelContainer )
  {
    LODWORD(v13) = HalSystemVectorDispatchEntry(v11, v10, v12);
    LODWORD(v14) = PsAttachSiloToCurrentThread(v13);
    PreviousSilo = v14;
    v65 = 1;
  }
  v15 = v6 & 1;
  if( (v6 & 1) == 0 )
  {
    if( (v6 & 4) == 0 )
      goto LABEL_10;
LABEL_5:
    active = -1073741582;
    goto LABEL_66;
  }
  if( (v6 & 2) != 0 || (v6 & 0x80000004) == 4 )
    goto LABEL_5;
  if( (PsGetCurrentProcess()[1].DirectoryTableBase & 0x1000000000000i64) == 0 )
  {
    active = -1073741801;
    goto LABEL_66;
  }
LABEL_10:
  active = MiGenerateSystemImageNames(ImageFileName, NamePrefix, LoadedBaseName, &BaseName, &v78, &PrefixedImageName);
  if( active < 0 )
    goto LABEL_66;
  v19 = 0;
  v64 = 1;
  P = 0i64;
  LOWORD(UnloadFlags) = 256;
  HIDWORD(UnloadFlags) = 0;
  CurrentThread = MmAcquireLoadLock(v18, v17);
  BaseDirectory = (_UNICODE_STRING *)&P;
  v20 = MiObtainSectionForDriver(&PrefixedImageName, ImageFileName, 0i64, (_KLDR_DATA_TABLE_ENTRY **)v6);
  v21 = (char *)P;
  active = v20;
  if( v20 < 0 )
    goto LABEL_116;
  v22 = (_SECTION *)*((_QWORD *)P + 14);
  Object = v22;
  if( v22 )
  {
    v23 = MiSectionControlArea(v22);
    TotalNumberOfPtes = v23->Segment->TotalNumberOfPtes;
  }
  else
  {
    v23 = 0i64;
    TotalNumberOfPtes = 0;
  }
  if( active )
  {
    v29 = (VOID **)(v21 + 48);
    v26 = (UINT8 *)*((_QWORD *)v21 + 6);
    a3 = v26;
    v73 = (INT8 **)(v21 + 48);
    if( (v6 & 1) != 0 )
    {
      inserted = MiSessionInsertImage(v26, v23);
      active = inserted;
      if( inserted < 0 )
      {
LABEL_37:
        MmReleaseLoadLock(CurrentThread);
        goto LABEL_61;
      }
      if( inserted == 272 )
      {
LABEL_42:
        *(_QWORD *)a5 = v21;
        *(_QWORD *)a6 = v26;
        if( (*((_DWORD *)v21 + 26) & 0x4000000) != 0 )
          active = -1073741411;
        else
          active = v15 == 0 ? 0xC000010E : 0;
        goto LABEL_37;
      }
      v29 = (VOID **)v73;
      v30 = 1;
      LOBYTE(UnloadFlags) = 1;
    }
    else
    {
      v30 = UnloadFlags;
    }
    if( active != 272 )
    {
      ++*((_WORD *)v21 + 54);
      LOBYTE(v25) = 0;
      goto LABEL_46;
    }
    goto LABEL_42;
  }
  v25 = 1;
  InitialLoad = 1;
  *((_DWORD *)v21 + 16) = TotalNumberOfPtes << 12;
  a3 = (UINT8 *)MiGetSystemAddressForImage(v22, v6, &SharePages);
  v26 = a3;
  if( !a3 )
  {
    ObDereferenceObjectDeferDelete((UINT64)Object);
    ExFreePoolWithTag(v21, 0);
    v27 = CurrentThread;
    active = -1073741670;
    v28 = ImageFileName;
LABEL_59:
    MmReleaseLoadLock(v27);
    if( !BYTE1(UnloadFlags) )
      MiLogFailedDriverLoad(v28, 0i64, 0i64, (unsigned int)active, (INT64)BaseDirectory);
    goto LABEL_61;
  }
  MiCheckPurgeAndUpMapCount(v23);
  v29 = (VOID **)(v21 + 48);
  v30 = v6 & 1;
  v73 = (INT8 **)(v21 + 48);
  *((_QWORD *)v21 + 6) = v26;
  LOBYTE(UnloadFlags) = v6 & 1;
  if( !(_BYTE)v15 )
  {
    v31 = MiControlAreaRequiresCharge((INT64)v23);
    v64 = v31;
    if( !v31 )
    {
      active = -1073740277;
LABEL_52:
      v19 = HIDWORD(UnloadFlags);
LABEL_53:
      v27 = CurrentThread;
      v28 = ImageFileName;
      goto LABEL_54;
    }
    if( v31 == 2 )
    {
      active = MiReferenceActiveSubsection((_SUBSECTION *)&v23[1], 0x88ui64, 0x11u);
      if( active < 0 )
      {
        v19 = HIDWORD(UnloadFlags);
        v31 = 1;
        v27 = CurrentThread;
        v28 = ImageFileName;
        goto LABEL_112;
      }
    }
    LODWORD(v66) = SharePages;
    goto LABEL_25;
  }
  LODWORD(v66) = SharePages;
LABEL_46:
  if( v30 != 1 || !dword_140C4C9F0 )
  {
LABEL_25:
    v32 = LoadFlagsa;
    goto LABEL_26;
  }
  if( (_BYTE)v25 == 1 )
  {
    if( !MiCreateSessionDriverProtos(v23, *v29, 0i64)
      || (PatchTableProtos = MiCreatePatchTableProtos(), (LoadFlagsa = (UINT64)PatchTableProtos) == 0) )
    {
      active = -1073741670;
      goto LABEL_51;
    }
    v32 = (UINT64)PatchTableProtos;
  }
  else
  {
    v32 = *((_QWORD *)v21 + 36);
    LoadFlagsa = v32;
  }
LABEL_26:
  MiMapSystemImage((_SECTION *)Object, v26, v32);
  active = v36;
  if( v36 < 0 )
  {
LABEL_51:
    v31 = v64;
    goto LABEL_52;
  }
  if( (v6 & 1) == 0 )
  {
    _InterlockedExchangeAdd((_DWORD *)&stru_140C4DB30 + 1144, TotalNumberOfPtes);
    v21 = (char *)P;
    LODWORD(v66) = SharePages;
  }
  v37 = a3;
  v38 = 0i64;
  HIDWORD(UnloadFlags) = 1;
  if( (v6 & 0x21) == 0
    && a3 == (UINT8 *)v23->Segment->ExtendInfo
    && (unsigned int)MiUseLargeDriverPage(&BaseName, v33, v34, v35)
    && (v39 = MiMapSystemImageWithLargePage((_SECTION *)Object, TotalNumberOfPtes, v37), (v38 = v39) != 0i64) )
  {
    _InterlockedExchangeAdd((_DWORD *)&xmmword_140C4CA88 + 3, -TotalNumberOfPtes);
    v40 = SharePages;
    v37 = (UINT8 *)v39;
    v21 = (char *)P;
    a3 = (UINT8 *)v39;
    LODWORD(v66) = SharePages;
    *v73 = v39;
  }
  else
  {
    v40 = v66;
  }
  BYTE1(UnloadFlags) = 0;
  if( InitialLoad != 1 )
    goto LABEL_84;
  LODWORD(v45) = RtlImageNtHeader((UINT64)v37);
  v46 = v45;
  if( !v45 )
  {
    active = -1073741279;
    goto LABEL_51;
  }
  if( *(_WORD *)(v45 + 4) != 0x8664 || *(_WORD *)(v45 + 24) != 523 )
  {
    active = -1073741520;
    goto LABEL_51;
  }
  if( (MiFlags & 0x10000) == 0 || (active = MiValidateStrongCodeDriverImage(v45, v6), active >= 0) )
  {
    v40 = v66;
    LODWORD(BaseDirectory) = v66;
    active = MiConstructLoaderEntry(
               (_KLDR_DATA_TABLE_ENTRY *)v21,
               &BaseName,
               &PrefixedImageName,
               v6,
               (UINT64)BaseDirectory,
               &NewDataTableEntry);
    if( active < 0 )
      goto LABEL_51;
    ExFreePoolWithTag(v21, 0);
    v48 = (void *)LoadFlagsa;
    v21 = (char *)NewDataTableEntry;
    if( LoadFlagsa )
    {
      LoadFlagsa = 0i64;
      NewDataTableEntry[1].CoverageSection = v48;
    }
LABEL_84:
    HIDWORD(UnloadFlags) = 5;
    if( v64 == 2 )
      *((_DWORD *)v21 + 49) |= 0x80u;
    if( !v38 && (v6 & 1) == 0 )
    {
      if( !v40 )
        goto LABEL_93;
      v49 = MiReferenceControlAreaFile(v23);
      IoIsDeviceEjectable(v49->DeviceObject);
      if( v52 || (*(_DWORD *)(v50 + 52) & 0x11) != 0 )
        v40 = 0;
      MiDereferenceControlAreaFile(v23, v51);
      if( !v40 )
LABEL_93:
        MiBackSingleImageWithPagefile((_KLDR_DATA_TABLE_ENTRY *)v21);
    }
    active = MiResolveImageImports((_KLDR_DATA_TABLE_ENTRY *)v21, NamePrefix, &v78, &BaseName, (INT64)&UnloadFlags + 1);
    if( active < 0
      || (active = MiProcessLoadConfigForDriver((_KLDR_DATA_TABLE_ENTRY *)v21, (_SUBSECTION *)&v23[1]), active < 0)
      || (active = MiFinalizeImageRetpolineState((INT64)v21), active < 0) )
    {
      v19 = HIDWORD(UnloadFlags);
    }
    else
    {
      v53 = a3;
      if( (v23->Segment->u2.ImageInformation->ExportedImageInformation.DllCharacteristics & 0x40) == 0 )
      {
        v54 = &a3[*((unsigned int *)v23->u2.SeImageStub->DynamicRelocations + 16)];
        MiSetImageProtection((_KLDR_DATA_TABLE_ENTRY *)v21, v54, 8ui64, 4ui64);
        LODWORD(v56) = MiRelocateAmount((const WCHAR *)v23, v55);
        *(_QWORD *)v54 = &v53[-v56];
        if( *(_QWORD *)&v23[1].gap8[8] )
          MiSetImageProtection((_KLDR_DATA_TABLE_ENTRY *)v21, v54, 8ui64, 0x100ui64);
      }
      MiFinalizeDriverImage((_KLDR_DATA_TABLE_ENTRY *)v21);
      active = v57;
      v19 = 23;
      if( v57 >= 0 )
      {
        active = MiApplyImportOptimizationToRuntimeDriver((INT64)v21, (UINT64)v23);
        if( active >= 0 )
        {
          if( (_BYTE)UnloadFlags != 1
            || (v6 & 4) == 0
            || (active = (unsigned int)MiCompactServiceTable((_VERIFIER_TRIAGE_RULE *)v21, v58, v59), active >= 0) )
          {
            active = MiHandleDriverNonPagedSections((_KLDR_DATA_TABLE_ENTRY *)v21, v6, 1ui64);
            if( active >= 0 )
            {
              v19 = 31;
              if( (_BYTE)UnloadFlags == 1 )
                MiSessionApplyNonPagedImageCharges(v53);
              active = MiFinalizeDriverCfgState((INT64)v21, v6, (INT64)&v23[1]);
              if( active >= 0 )
              {
                active = MiApplyRequiredDriverHotPatches((__int64)v21, v60, v61);
                if( active >= 0 )
                {
                  v28 = ImageFileName;
                  MiDriverLoadSucceeded(
                    (_KLDR_DATA_TABLE_ENTRY *)v21,
                    (_SECTION *)Object,
                    ImageFileName,
                    &PrefixedImageName,
                    &BaseName,
                    InitialLoad,
                    UnloadFlags);
                  v27 = CurrentThread;
                  MmReleaseLoadLock(CurrentThread);
                  active = 0;
                  *(_QWORD *)a5 = v21;
                  *(_QWORD *)a6 = v53;
                  goto LABEL_111;
                }
              }
            }
          }
        }
      }
    }
LABEL_116:
    v31 = v64;
    goto LABEL_53;
  }
  memset(&DataTableEntry, 0i64, sizeof(DataTableEntry));
  DataTableEntry.CheckSum = *(_DWORD *)(v46 + 88);
  v47 = *(_DWORD *)(v46 + 8);
  DataTableEntry.BaseDllName = BaseName;
  DataTableEntry.TimeDateStamp = v47;
  MiLogStrongCodeDriverLoadFailure((INT8 *)"SectionWXable", &DataTableEntry);
  v19 = HIDWORD(UnloadFlags);
  v27 = CurrentThread;
  v28 = ImageFileName;
LABEL_111:
  v31 = v64;
LABEL_112:
  if( active < 0 )
  {
LABEL_54:
    if( v21 )
    {
      if( v31 == 2 && (v19 & 4) == 0 )
      {
        v42 = MiSectionControlArea(*((_SECTION **)v21 + 14));
        MiReturnCrossPartitionControlAreaCharges((INT64)v42);
      }
      MiUnloadSystemImage(v21, v19);
    }
    goto LABEL_59;
  }
LABEL_61:
  if( NamePrefix )
    ExFreePoolWithTag(PrefixedImageName.Buffer, 0);
  if( InitialLoad == 1 && LoadFlagsa )
    MiFreePatchTableProtos((PVOID)LoadFlagsa);
LABEL_66:
  if( v65 )
    PsDetachSiloFromCurrentThread(PreviousSilo);
  return active;
}

Referenced by: