MiProcessKernelCfgImage
INT64 __fastcall MiProcessKernelCfgImage(INT64 a1, CHAR a2, INT64 a3){
INT64 result;
PIMAGE_NT_HEADERS NtHeader;
NtHeader = 0i64;
if( (MiFlags & 0x80000) == 0 )
return 0i64;
RtlImageNtHeaderEx(1ui64, *(PVOID *)(a1 + 48), 0i64, &NtHeader);
if( (*(_DWORD *)(a1 + 104) & 0x2000) == 0 )
{
result = MiMarkKernelImageCfgBits(a1, (__int64)NtHeader);
if( (int)result < 0 )
return result;
*(_DWORD *)(a1 + 104) |= 0x2000u;
}
if( !a3 )
return 0i64;
if( (a2 & 8) != 0 )
return 0i64;
result = MiProcessKernelCfgAddressTakenImports(a1);
if( (int)result >= 0 )
return 0i64;
return result;
}Referenced by:
MiFinalizeDriverCfgState
MiInitializeKernelCfg