MiHotPatchImage

VOID __stdcall MiHotPatchImage(INT64 a1, INT64 a2, WCHAR a3, INT64 r9_0){
  unsigned int v4; 
  UINT64 v5; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  int v8; 
  _QWORD *ProcessHotPatchContext; 
  int v10; 
  NTSTATUS ProcessImageHotPatchRecord; 
  unsigned int v12; 
  unsigned int v13; 
  INT64 v14; 
  __int64 v15; 
  INT64 v16; 
  int v17; 
  _UNICODE_STRING v18; 
  int v19; 
  NTSTATUS v20; 
  INT64 v21; 
  INT64 v22; 
  INT64 v23; 
  __int64 v24; 
  __int64 v25; 
  INT64 v26; 
  _UNICODE_STRING DestinationString; 
  int v28; 
  INT64 v29; 
  _ETHREAD *v30; 
  _EPROCESS *v31; 
  _EX_RUNDOWN_REF *RunRef; 
  _UNICODE_STRING v33; 
  INT64 a4; 
  INT64 v35; 
  INT64 v36; 
  INT64 v37; 
  char v38; 
  int v39; 

  LODWORD(v36) = r9_0;
  v35 = a2;
  a4 = a1;
  v26 = 0i64;
  v29 = 0i64;
  v4 = r9_0;
  DestinationString = 0i64;
  v5 = a3;
  RtlInitUnicodeString(&DestinationString, 0i64);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v30 = CurrentThread;
  Process = CurrentThread->Tcb.ApcState.Process;
  v31 = Process;
  RunRef = &Process->RundownProtect;
  if( ExAcquireRundownProtection(&Process->RundownProtect) )
  {
    v8 = v39;
    ProcessHotPatchContext = 0i64;
    v10 = 1;
    while( 1 )
    {
      ProcessImageHotPatchRecord = MiFindProcessImageHotPatchRecord(
                                     Process,
                                     v4,
                                     (unsigned int)v37,
                                     &DestinationString,
                                     (INT64)&v26);
      LODWORD(a4) = ProcessImageHotPatchRecord;
      v12 = ProcessImageHotPatchRecord;
      if( ProcessImageHotPatchRecord >= 0 )
      {
        v13 = v26;
      }
      else
      {
        if( ProcessImageHotPatchRecord != -1073741275 )
          goto LABEL_26;
        if( v8 || !MiGetProcessHotPatchContext((__int64)Process, 0) )
        {
          v12 = 1075380276;
LABEL_25:
          v10 = 0;
          goto LABEL_26;
        }
        v13 = 0;
        LODWORD(v26) = 0;
      }
      if( !ProcessHotPatchContext )
      {
        ProcessHotPatchContext = MiGetProcessHotPatchContext((__int64)Process, 1);
        if( !ProcessHotPatchContext )
        {
          v12 = -1073741670;
          goto LABEL_26;
        }
      }
      LODWORD(v14) = MiGetHotPatchEntry((_RTL_RB_TREE *)ProcessHotPatchContext, v5, v13, &a4);
      v16 = v14;
      if( !v14 )
        break;
      LOBYTE(v25) = v38;
      LODWORD(v24) = v37;
      LODWORD(v22) = v36;
      HIDWORD(v26) = 1;
      v17 = MiPerformImageHotPatch(
              (INT64)ProcessHotPatchContext,
              v14,
              v15,
              v35,
              v5,
              &DestinationString,
              v22,
              v24,
              v25,
              &v29);
      LODWORD(a4) = v17;
      --CurrentThread->Tcb.SpecialApcDisable;
      ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)ProcessHotPatchContext + 2, 0i64);
      LODWORD(v23) = v17;
      MiLogHotPatchOperation(v16, (unsigned int)v36, (unsigned int)v37, v13, &v29, &DestinationString.Length, v23);
      *(_DWORD *)(v16 + 92) &= ~1u;
      v28 = *(_DWORD *)(v16 + 92);
      if( v17 < 0 )
      {
        LOBYTE(v19) = v28;
      }
      else
      {
        v18 = *(_UNICODE_STRING *)(v16 + 64);
        *(_DWORD *)(v16 + 48) = v36;
        *(_DWORD *)(v16 + 52) = v37;
        *(_QWORD *)(v16 + 80) = v29;
        *(_DWORD *)(v16 + 88) = v13;
        *(_UNICODE_STRING *)(v16 + 64) = DestinationString;
        DestinationString = v18;
        v19 = *(_DWORD *)(v16 + 92);
        v33 = v18;
      }
      if( (_InterlockedExchangeAdd64(ProcessHotPatchContext + 2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)ProcessHotPatchContext + 2);
      KeAbPostRelease(ProcessHotPatchContext + 2);
      CurrentThread = v30;
      KiLeaveGuardedRegionUnsafe((__int64)v30);
      v12 = a4;
      if( (int)a4 < 0 )
        goto LABEL_25;
      if( (v19 & 2) != 0 )
      {
        MiDeleteHotPatchEntry((PVOID)v16);
        HIDWORD(v26) = 0;
        goto LABEL_25;
      }
      v8 = 0;
      RtlFreeAnsiString(&DestinationString);
      RtlInitUnicodeString(&DestinationString, 0i64);
      Process = v31;
      v4 = v36;
    }
    v12 = a4;
    if( (int)a4 >= 0 && (_DWORD)a4 != 259 )
      goto LABEL_25;
LABEL_26:
    if( HIDWORD(v26) )
    {
      MiLockVadShared((INT64)CurrentThread, v5);
      v20 = MiVadDeleted((_MMVAD_SHORT *)v5);
      MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)v5);
      if( v20 )
        MiDeleteImageHotPatchState(v5);
    }
    if( v10 )
    {
      LODWORD(v21) = 0;
      MiLogHotPatchOperationStatus(
        (unsigned int)v36,
        (unsigned int)v37,
        (PFN_WDFCX_DEVICE_POST_SELF_MANAGED_IO_INIT *)&DestinationString,
        v12,
        v21);
    }
    ExReleaseRundownProtection(RunRef);
  }
  RtlFreeAnsiString(&DestinationString);
}

Referenced by: