MiApplyDriverHotPatch

INT64 __stdcall MiApplyDriverHotPatch(INT64 rcx0, INT64 a2){
  int v2; 
  UINT64 *v5; 
  INT64 result; 
  UINT64 *a13; 
  unsigned int v8; 
  void *v9; 
  int v10; 
  unsigned int v11; 
  void *v12; 
  int SectionStrongImageReference; 
  VOID *v14; 
  __int64 v15; 
  INT64 v16; 
  NTSTATUS v17; 
  int v18; 
  POPLOCK_FS_PREPOST_IRP PostIrpRoutine; 
  INT64 v20; 
  INT64 a11; 
  INT64 a15; 
  INT64 v23; 
  INT64 v24; 
  INT64 v25; 
  INT64 a1[2]; 
  unsigned int v27; 
  __int64 v28; 
  int v29; 
  __int64 v30; 
  __int64 v31; 
  __int64 v32; 
  __int64 v33; 
  INT64 v34[2]; 
  int v35; 
  __int64 v36; 
  int v37; 
  __int64 v38; 
  __int64 v39; 
  __int64 v40; 
  __int64 v41; 
  INT64 a18[10]; 
  int a2a; 
  CHAR *HotPatchBase; 
  v2 = *(_DWORD *)(a2 + 196);
  v36 = 0i64;
  v37 = 0;
  v39 = 0i64;
  v5 = 0i64;
  v41 = 0i64;
  v28 = 0i64;
  v29 = 0;
  v31 = 0i64;
  v33 = 0i64;
  a2a = 0;
  if( (v2 & 0x20) != 0 )
    return 3221225496i64;
  a13 = (UINT64 *)RtlFindHotPatchInformation(*(PVOID *)(rcx0 + 48));
  HotPatchBase = RtlFindHotPatchBase(a13);
  if( !HotPatchBase )
    return 3221225595i64;
  v8 = *(_DWORD *)(a2 + 64);
  v34[0] = a2;
  v38 = 0i64;
  v40 = 0i64;
  v9 = 0i64;
  v10 = (v8 >> 12) + ((v8 & 0xFFF) != 0);
  v34[1] = (INT64)HotPatchBase;
  v11 = *(_DWORD *)(rcx0 + 64);
  v35 = v10;
  a1[0] = rcx0;
  a1[1] = 0i64;
  v27 = (v11 >> 12) + ((v11 & 0xFFF) != 0);
  v30 = 0i64;
  v32 = 0i64;
  if( !*(_QWORD *)(a2 + 280) )
    goto LABEL_11;
  LODWORD(result) = VslDetermineHotPatchUndoTableSize(*(_QWORD *)(a2 + 48), &a2a);
  if( (int)result < 0 )
    return result;
  if( !a2a )
    goto LABEL_11;
  LODWORD(v12) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
  v9 = v12;
  if( !v12 )
    return 3221225626i64;
  SectionStrongImageReference = VslObtainHotPatchUndoTable(*(PVOID *)(a2 + 48));
  if( SectionStrongImageReference >= 0 )
  {
LABEL_11:
    v14 = *(VOID **)(a2 + 136);
    if( (*(_DWORD *)(rcx0 + 196) & 0x20) != 0
      || v14 == (VOID *)1
      || (v5 = MiAddEntryToImportList(*(INT64 **)(a2 + 136), rcx0)) != 0i64 )
    {
      SectionStrongImageReference = MiPrepareDriverPatchState((INT64)v34);
      if( SectionStrongImageReference >= 0 )
      {
        SectionStrongImageReference = MiPrepareDriverPatchState((INT64)a1);
        if( SectionStrongImageReference >= 0 )
        {
          SectionStrongImageReference = MiIdentifyPatchImageWritablePages(a1);
          if( SectionStrongImageReference >= 0 )
          {
            if( (*(_DWORD *)(rcx0 + 196) & 0x20) != 0
              || (a18[1] = 0i64,
                  v15 = *((unsigned int *)HotPatchBase + 6),
                  a18[0] = (INT64)MiCheckHotPatchApplicable,
                  a18[2] = (INT64)a1,
                  LODWORD(a15) = 2,
                  LODWORD(a11) = 0,
                  SectionStrongImageReference = RtlApplyHotPatch(
                                                  *(_QWORD *)(v34[0] + 48),
                                                  *(_QWORD *)(v34[0] + 48),
                                                  0i64,
                                                  0i64,
                                                  0i64,
                                                  (INT64)PostIrpRoutine,
                                                  v20,
                                                  *(_QWORD *)(a1[0] + 48),
                                                  *(_QWORD *)(a1[0] + 48),
                                                  0i64,
                                                  a11,
                                                  0i64,
                                                  (INT64)a13,
                                                  (INT64)a13 + v15,
                                                  a15,
                                                  0i64,
                                                  0i64,
                                                  (INT64)a18,
                                                  v23,
                                                  v24,
                                                  v25),
                  SectionStrongImageReference >= 0) )
            {
              SectionStrongImageReference = MiPrepareDriverForHotPatch(v34, a1, a13, (INT64)v9);
              if( SectionStrongImageReference >= 0 )
              {
                v16 = *((_QWORD *)MiSectionControlArea(*(_SECTION **)(rcx0 + 112)) + 12);
                SectionStrongImageReference = MiGetSectionStrongImageReference(v16);
                if( SectionStrongImageReference >= 0 )
                {
                  v17 = VslApplyHotPatch(
                          *(POPLOCK *)(v16 + 56),
                          *(PIRP *)(rcx0 + 112),
                          *(_QWORD *)(a2 + 48),
                          (PVOID)a2,
                          *(POPLOCK_WAIT_COMPLETE_ROUTINE *)(rcx0 + 48),
                          (POPLOCK_FS_PREPOST_IRP)rcx0);
                  SectionStrongImageReference = v17;
                  if( v17 >= 0 )
                  {
                    if( v5 )
                    {
                      *(_QWORD *)(a2 + 136) = v5;
                      MiFreeLoadedImportList(v14);
                      v5 = 0i64;
                    }
                    *(_QWORD *)(a2 + 280) = rcx0;
                    v18 = *(_DWORD *)(rcx0 + 196);
                    if( (v18 & 0x20) == 0 )
                    {
                      *(_QWORD *)(rcx0 + 280) = a2;
                      *(_DWORD *)(rcx0 + 196) = v18 | 0x20;
                    }
                  }
                  else if( v17 == -1073740628 )
                  {
                    KeBugCheckEx(0x1Au, 0x485018ui64, *(_QWORD *)(a2 + 48), *(_QWORD *)(rcx0 + 48), 0i64);
                  }
                }
              }
            }
          }
        }
      }
    }
    else
    {
      SectionStrongImageReference = -1073741670;
    }
  }
  MiUnlockDriverPages((UINT64 *)v34);
  MiUnlockDriverPages((UINT64 *)a1);
  if( v9 )
    ExFreePoolWithTag(v9, 0);
  if( v5 )
    MiFreeLoadedImportList(v5);
  return(unsigned int)SectionStrongImageReference;
}

Referenced by: