MiBuildImportsForBootDrivers
INT64 __fastcall MiBuildImportsForBootDrivers(){
PVOID *v0;
int v1;
unsigned int v2;
PVOID *v3;
PVOID *v4;
PVOID v5;
__int16 v6;
void **v7;
void **v8;
PVOID *i;
unsigned __int64 *v10;
unsigned __int64 *v11;
PVOID v12;
unsigned int v13;
unsigned __int64 v14;
unsigned int j;
unsigned int v16;
unsigned __int64 v17;
void **v18;
__int64 v19;
PVOID *v20;
_QWORD *v21;
unsigned int v22;
void **v23;
__int64 v24;
PVOID *v25;
PVOID *v26;
int v27;
unsigned __int64 v28;
unsigned __int64 v29;
PVOID *k;
PVOID v32;
UINT64 Size;
PVOID *v34;
v0 = (PVOID *)PsLoadedModuleList;
v1 = 0;
v34 = &PsLoadedModuleList;
LODWORD(Size) = 0;
v2 = 0;
v3 = 0i64;
v4 = 0i64;
if( PsLoadedModuleList == &PsLoadedModuleList )
return 3221226021i64;
do
{
v5 = v0[6];
if( (PVOID)PsNtosImageBase == v5 )
{
v3 = v0;
}
else if( PsHalImageBase == v5 )
{
v4 = v0;
}
v6 = ((_DWORD)v0[13] & 0x4000000) == 0 || v0 == v4 || v0 == v3;
*((_WORD *)v0 + 54) = v6;
++v2;
v0[17] = (PVOID)1;
v0 = (PVOID *)*v0;
}
while( v0 != &PsLoadedModuleList );
if( !v3 || !v4 )
return 3221226021i64;
LODWORD(v7) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
v8 = v7;
if( v7 )
{
for( i = (PVOID *)PsLoadedModuleList; i != &PsLoadedModuleList; i = (PVOID *)*i )
{
LODWORD(v10) = RtlImageDirectoryEntryToData(i[6], 1u, 0xCu, &Size);
v11 = v10;
if( !v10 )
goto LABEL_15;
memset((INT64)v8, 0i64);
v12 = 0i64;
v13 = (unsigned int)Size >> 3;
v14 = 0i64;
for( j = 0; j < v13; ++v11 )
{
if( !v12 || *v11 < (unsigned __int64)v12 || *v11 >= v14 )
{
v26 = (PVOID *)PsLoadedModuleList;
v27 = 0;
if( PsLoadedModuleList != &PsLoadedModuleList )
{
v28 = *v11;
while( 1 )
{
v12 = v26[6];
v14 = (unsigned __int64)v12 + *((unsigned int *)v26 + 16);
if( v28 >= (unsigned __int64)v12 && v28 < v14 )
break;
v26 = (PVOID *)*v26;
++v27;
if( v26 == v34 )
goto LABEL_40;
}
v8[v27] = v26;
}
LABEL_40:
v29 = *v11;
if( *v11 < (unsigned __int64)v12 || v29 >= v14 )
{
if( v29 )
goto LABEL_59;
v12 = 0i64;
}
}
++j;
}
LODWORD(Size) = 0;
v16 = 0;
v17 = 0i64;
if( !v2 )
goto LABEL_15;
v18 = v8;
v19 = v2;
do
{
v20 = (PVOID *)*v18;
if( *v18 && v20 != v3 && v20 != i && v20 != v4 )
{
v17 = (unsigned __int64)*v18;
++v16;
}
++v18;
--v19;
}
while( v19 );
LODWORD(Size) = v16;
if( v16 )
{
if( v16 == 1 )
{
i[17] = (PVOID)(v17 | 1);
++*(_WORD *)(v17 + 108);
}
else
{
if( v16 > 0x1FFFFFFE || (LODWORD(v21) = MiAllocatePool((struct _SLIST_ENTRY *)0x100), !v21) )
{
LABEL_59:
v1 = 1;
break;
}
v22 = 0;
*v21 = v16;
v23 = v8;
v24 = v2;
do
{
v25 = (PVOID *)*v23;
if( *v23 && v25 != v3 && v25 != i && v25 != v4 )
{
v21[v22 + 1] = v25;
++*((_WORD *)*v23 + 54);
++v22;
}
++v23;
--v24;
}
while( v24 );
i[17] = v21;
}
}
else
{
LABEL_15:
i[17] = (PVOID)-2i64;
}
}
ExFreePoolWithTag(v8, 0);
v3[17] = (PVOID)1;
v4[17] = (PVOID)1;
if( v1 != 1 )
return 0i64;
for( k = (PVOID *)PsLoadedModuleList; k != &PsLoadedModuleList; k = (PVOID *)*k )
{
v32 = k[17];
if( v32 != (PVOID)1 && v32 != (PVOID)-2i64 && ((unsigned __int8)v32 & 1) == 0 )
ExFreePoolWithTag(v32, 0);
k[17] = (PVOID)1;
*((_WORD *)k + 54) = 1;
}
}
return 3221225626i64;
}Referenced by:
MiInitializeLoadedModuleList