MiWriteProtectSystemImages

VOID __stdcall MiWriteProtectSystemImages(){
  INT64 v0; 
  _ETHREAD *CurrentThread; 
  _KLDR_DATA_TABLE_ENTRY *i; 
  _SECTION *SectionPointer; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceExclusiveLite((UINT64)&PsLoadedModuleResource, 1, v0);
  for( i = (_KLDR_DATA_TABLE_ENTRY *)PsLoadedModuleList;
        i != (_KLDR_DATA_TABLE_ENTRY *)&PsLoadedModuleList;
        i = (_KLDR_DATA_TABLE_ENTRY *)i->InLoadOrderLinks.Flink )
  {
    SectionPointer = (_SECTION *)i->SectionPointer;
    if( !SectionPointer || !*(_QWORD *)&MiSectionControlArea(SectionPointer)[1].gap8[8] || (i->Flags & 0x8000000) == 0 )
      MiProtectSystemImage(i);
  }
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}

Referenced by: