MiReadImageHeaders

NTSTATUS __stdcall MiReadImageHeaders(
        FILE_OBJECT *FileObject,
        INT64 BugCheckParameter3,
        MDL *MemoryDescriptorList,
        LARGE_INTEGER *Timeout){
  __int64 v5; 
  _EPROCESS *Process; 
  __int64 v7; 
  unsigned __int64 v8; 
  NTSTATUS v11; 
  NTSTATUS LowPart; 
  LARGE_INTEGER v13; 
  _MDL *i; 
  _EPROCESS *v16; 
  unsigned __int64 v17; 
  UINT8 *MappedSystemVa; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  UINT64 v21; 
  UINT8 *v22; 
  __int64 v23; 
  UINT64 Flags; 
  struct _KEVENT Event; 
  _LARGE_INTEGER StartingOffset; 
  v5 = (__int64)MemoryDescriptorList->MappedSystemVa & 0xFFF;
  Process = MemoryDescriptorList->Process;
  v7 = MemoryDescriptorList->ByteCount + 4095i64;
  Timeout[1].QuadPart = 0i64;
  v8 = (unsigned __int64)(v5 + v7) >> 12;
  StartingOffset.QuadPart = (_QWORD)Process << 12;
  if( BugCheckParameter3 )
  {
    LowPart = MiCopyFromDirectMapExtent((PVOID)BugCheckParameter3);
  }
  else
  {
    memset(&Event, 0, sizeof(Event));
    KeInitializeEvent(&Event, NotificationEvent, 0);
    LODWORD(Flags) = 2;
    MiPageRead(FileObject, MemoryDescriptorList, &StartingOffset, &Event, (_IO_STATUS_BLOCK *)Timeout, Flags, 0i64);
    LowPart = v11;
    if( v11 == 259 )
    {
      KeWaitForSingleObject(&Event, WrPageIn, 0, 0, 0i64);
      LowPart = Timeout->LowPart;
    }
  }
  if( LowPart < 0 )
  {
    dword_140C4C958 = 32;
    if( !(unsigned int)MiIsRetryIoStatus((unsigned int)LowPart, 0i64)
      && LowPart != -1073741740
      && LowPart != -1073741209 )
    {
      return -1073741792;
    }
  }
  else
  {
    v13 = Timeout[1];
    if( v13.QuadPart != v8 << 12 )
      memset((INT64)MemoryDescriptorList->MappedSystemVa + v13.QuadPart, 0i64);
    for( i = MemoryDescriptorList->Next; i; i = i->Next )
    {
      v16 = i->Process;
      v17 = (((__int64)i->MappedSystemVa & 0xFFF) + (unsigned __int64)i->ByteCount + 4095) >> 12;
      if( Process < (_EPROCESS *)((char *)v16 + v17) && (_EPROCESS *)((char *)Process + v8) > v16 )
      {
        MappedSystemVa = (UINT8 *)MemoryDescriptorList->MappedSystemVa;
        if( v16 > Process )
        {
          v23 = v16 - Process;
          v22 = (UINT8 *)i->MappedSystemVa;
          if( v8 - v23 <= v17 )
            v17 = v8 - v23;
          MappedSystemVa += 4096 * v23;
          v21 = v17 << 12;
        }
        else
        {
          v19 = v8;
          v20 = v17 - (Process - v16);
          if( v20 <= v8 )
            v19 = v20;
          v21 = v19 << 12;
          v22 = (UINT8 *)i->MappedSystemVa + 4096 * (Process - v16);
        }
        memmove(MappedSystemVa, v22, v21);
      }
    }
  }
  return LowPart;
}

Referenced by: