MiParseImageLoadConfig
INT64 __fastcall MiParseImageLoadConfig(INT64 rcx0, CHAR *rdx0, UINT64 a3, INT64 a4, INT64 a5, INT64 a6){
unsigned int v7;
_FILE_OBJECT *v10;
int RetpolineRelocationInformation;
__int64 v12;
__int64 v13;
unsigned int v14;
__int16 v15;
unsigned int v16;
UINT8 *v17;
unsigned int v18;
INT64 v19;
__int64 v20;
INT64 v21;
int v22;
INT64 v23;
int v25;
INT64 v26;
size_t v27;
UINT64 v28;
INT64 a7;
_CONTROL_AREA *v30;
UINT64 v31;
int v32;
__int64 v33;
__int64 v34;
UINT64 v35;
__int64 v36;
INT64 v37;
CHAR *v38;
INT64 v39;
INT64 v40;
CHAR *v41;
INT64 v42;
CHAR *v43;
INT64 v44;
INT64 v45[4];
int v46;
int v47;
INT64 v48;
INT64 *v49;
unsigned int v50;
INT64 v51[3];
INT64 a2;
_QWORD a1[4];
UINT8 Src[4];
int v55;
int v56;
INT64(__fastcall *v57)(INT64, INT64, INT64 *);
INT64(__fastcall *v58)(_DWORD *, UINT64 **, INT64 *);
__int128 v59;
UINT8 result[288];
v7 = a3;
v30 = (_CONTROL_AREA *)rcx0;
v37 = rcx0;
v42 = rcx0;
v38 = rdx0;
v43 = rdx0;
v32 = a3;
v39 = a4;
v44 = a4;
v40 = a6;
memset((INT64)result, 0i64);
v10 = 0i64;
v36 = 0i64;
a7 = 0i64;
RetpolineRelocationInformation = 0;
memset((INT64)v45, 0i64);
v12 = *(_QWORD *)(*(_QWORD *)rcx0 + 56i64);
v33 = v12;
v34 = v12;
v31 = *(_QWORD *)a4;
v35 = v31;
v13 = *(unsigned int *)(a4 + 96);
if( (_DWORD)v13 )
{
v14 = *(_DWORD *)(a4 + 100);
v15 = *(_WORD *)(a4 + 48);
if( v15 == 523 )
{
v16 = 148;
}
else
{
if( v15 != 267 )
goto LABEL_29;
v16 = 92;
}
if( (unsigned int)v13 + v16 > (unsigned int)v13 && (unsigned int)v13 + v16 <= *(_DWORD *)(a4 + 16) )
{
v17 = (UINT8 *)&rdx0[v13];
v41 = &rdx0[v13];
if( v14 >= v16 )
goto LABEL_7;
if( *(_WORD *)(v12 + 48) == 332 )
{
if( v14 > 4 )
v14 = *(_DWORD *)v17;
if( v14 >= v16 )
{
LABEL_7:
if( v14 >= 0x118 )
v14 = 280;
v18 = *(_DWORD *)(a4 + 96);
if( v18 + v14 > v18 && v18 + v14 <= *(_DWORD *)(a4 + 16) )
{
memmove(result, v17, v14);
v10 = MiReferenceControlAreaFile(v30);
MiLogRelocationRva(*(_DWORD *)(a4 + 96), v14, v10, (__int64)v30);
v45[0] = v42;
v45[1] = (INT64)v10;
v45[2] = (INT64)v43;
v45[3] = v31;
v46 = v32;
v47 = 0;
v48 = v44;
v49 = (INT64 *)result;
v50 = v14;
LODWORD(v28) = v14;
RetpolineRelocationInformation = MiCaptureImageCfgContext(
(INT64)v30,
(INT64)v10,
(INT64)rdx0,
v31,
v7,
v26,
a4,
(INT64)result,
v28,
&a7,
(INT64)v51);
if( RetpolineRelocationInformation >= 0 )
{
v19 = (unsigned int)a7 | *(_DWORD *)a6;
*(_DWORD *)a6 = v19;
v20 = v33;
*(_DWORD *)(a6 + 4) = *(_WORD *)(v33 + 48) == 452;
*(_WORD *)(a6 + 8) = *(_WORD *)(v20 + 48);
v21 = 0i64;
if( (v19 & 1) != 0 )
{
*(_DWORD *)Src = 1;
v57 = MiImageCfgRvaIteratorFirst;
v58 = MiImageCfgRvaIteratorNext;
v21 = 1i64;
if( (v19 & 8) != 0 )
{
v55 = 4;
v59 = 0i64;
v21 = 2i64;
}
}
v56 = v21;
if( !(_DWORD)v21
|| (RetpolineRelocationInformation = RtlCreateRvaList(v45, v19, 452i64, v21, Src, v27, a6 + 16),
RetpolineRelocationInformation >= 0) )
{
if( (MiIsRetpolineEnabled() || MiIsImportOptimizationEnabled()) && *(_WORD *)(a4 + 48) == 523 )
{
LODWORD(v27) = v14;
v22 = MiCaptureDynamicRelocationTableRva(rdx0, v7, v31, 523, (INT64)result, v27, (INT64)&a7 + 4);
RetpolineRelocationInformation = v22;
if( v22 == -1073741637 )
{
LABEL_21:
RetpolineRelocationInformation = 0;
goto LABEL_22;
}
if( v22 >= 0 )
{
v25 = MiCaptureRetpolineRelocationTables(rdx0, v7, v23, HIDWORD(a7), a1);
RetpolineRelocationInformation = v25;
if( v25 == -1073741637 )
goto LABEL_21;
if( v25 >= 0 )
RetpolineRelocationInformation = MiCreateRetpolineRelocationInformation(
(INT64)a1,
(unsigned int)a2,
v7,
(_QWORD *)(a6 + 24));
}
}
}
}
}
}
}
}
}
LABEL_29:
if( RetpolineRelocationInformation < 0 )
MiFreeImageLoadConfig(a6);
LABEL_22:
if( v10 )
MiDereferenceControlAreaFile((__int64)v30, (unsigned __int64)v10);
MiFreeImageCfgContext((INT64)v51);
MiFreeImageRetpolineContext(a1);
return(unsigned int)RetpolineRelocationInformation;
}Referenced by:
MiRelocateImage