MiGetProcessHotPatchContext
_QWORD *__fastcall MiGetProcessHotPatchContext(INT64 a1, INT64 a2){
_QWORD *result;
_QWORD *v4;
_QWORD *v5;
result = *(_QWORD **)(a1 + 2552);
if( !result )
{
if( (_DWORD)a2 && (LODWORD(v4) = MiAllocatePool((struct _SLIST_ENTRY *)0x40), v4) )
{
*v4 = 0i64;
v4[1] = 0i64;
v4[4] = v4 + 3;
v4[3] = v4 + 3;
v4[2] = 0i64;
v5 = (_QWORD *)_InterlockedCompareExchange64((volatile signed __int64 *)(a1 + 2552), (signed __int64)v4, 0i64);
if( !v5 )
return v4;
ExFreePoolWithTag(v4, 0);
return v5;
}
else
{
return 0i64;
}
}
return result;
}Referenced by:
MiDeleteImageHotPatchState
MiHotPatchImage
MiLogHotPatchRundown
MiQueryProcessActivePatches
MmPostHotPatchDbgModuleMessages