MiConstructLoaderEntry
__int64 __fastcall MiConstructLoaderEntry(__int64 a1, const void **a2, const void **a3, int a4, int a5, __int64 *a6){
char v9;
_OWORD *v10;
UINT8 *v11;
UINT8 *v12;
unsigned __int64 v13;
IMAGE_NT_HEADERS *v14;
int v15;
IMAGE_NT_HEADERS *v16;
unsigned __int64 NumberOfSections;
UINT8 *v18;
unsigned int v19;
unsigned int v20;
__int64 v21;
__int64 v22;
unsigned __int64 v23;
unsigned __int64 v24;
_OWORD *v25;
_OWORD *v26;
_SECTION *v27;
_CONTROL_AREA *v28;
_OWORD *v29;
char *v30;
UINT8 *v31;
bool v32;
int v33;
_CONTROL_AREA *v34;
__int16 v35;
unsigned __int64 v36;
VOID *SectionInfo;
__int64 VirtualAddress;
unsigned __int64 Size;
unsigned int SizeOfImage;
unsigned int v42;
char *v43;
unsigned __int64 v44;
unsigned int v45;
int v46;
unsigned __int64 v47;
unsigned int v48;
__int64 v49;
unsigned int *v50;
__int64 v51;
unsigned int v52;
unsigned int v53;
__int64 v54;
unsigned __int128 v55;
unsigned __int64 v56;
unsigned int v57;
__int64 v58;
unsigned int v59;
int v60;
__int64 v61;
__int64 v62;
_IMAGE_DATA_DIRECTORY *v63;
__int128 v64;
_OWORD *v65;
_SECTION *Section;
_CONTROL_AREA *v67;
INT64 result[26];
UINT64 CoverageSectionSize;
int v72;
v72 = a4;
v9 = a4;
memset((INT64)result, 0i64);
v58 = 0i64;
*a6 = 0i64;
v10 = 0i64;
DWORD1(v64) = 0;
LODWORD(v11) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
*((_QWORD *)&v64 + 1) = v11;
v12 = v11;
if( !v11 )
return(unsigned int)-1073741670;
LOWORD(v64) = *(_WORD *)a3;
WORD1(v64) = *(_WORD *)a3;
memmove(v11, (UINT8 *)a3[1], *(unsigned __int16 *)a3);
*(_WORD *)&v12[2 * ((unsigned __int64)*(unsigned __int16 *)a3 >> 1)] = 0;
v13 = *(_QWORD *)(a1 + 48);
v14 = RtlImageNtHeader((PVOID)v13);
v15 = v9 & 1;
v16 = v14;
v60 = v15;
if( (v9 & 1) != 0 )
{
LODWORD(NumberOfSections) = 0;
LODWORD(CoverageSectionSize) = 0;
}
else
{
NumberOfSections = v14->FileHeader.NumberOfSections;
LODWORD(CoverageSectionSize) = v14->FileHeader.NumberOfSections;
if( 0xFFFFFFFFFFFFFFFFui64 / NumberOfSections < 4 )
{
v57 = -1073741520;
goto LABEL_77;
}
}
v63 = 0i64;
v18 = 0i64;
v19 = 0;
if( v15 )
{
v19 = 32;
if( v14->OptionalHeader.NumberOfRvaAndSizes > 6 )
{
VirtualAddress = v14->OptionalHeader.DataDirectory[6].VirtualAddress;
v63 = &v16->OptionalHeader.DataDirectory[6];
if( (_DWORD)VirtualAddress )
{
Size = v16->OptionalHeader.DataDirectory[6].Size;
if( (_DWORD)Size )
{
if( (int)Size + (int)VirtualAddress > (unsigned int)VirtualAddress )
{
SizeOfImage = v16->OptionalHeader.SizeOfImage;
if( (int)Size + (int)VirtualAddress < SizeOfImage )
{
v19 = Size + 32;
v42 = 0;
v43 = (char *)(v13 + VirtualAddress);
v44 = Size / 0x1C;
if( v44 )
{
do
{
v45 = *((_DWORD *)v43 + 5);
if( v45 )
{
if( v45 < SizeOfImage )
{
v46 = *((_DWORD *)v43 + 4);
if( v46 + v45 < SizeOfImage )
v19 += v46;
}
}
++v42;
v43 += 28;
}
while( v42 < v44 );
}
v18 = (UINT8 *)&v43[-28 * v42];
}
}
}
}
v19 = (v19 + 7) & 0xFFFFFFF8;
}
}
v20 = (v16->OptionalHeader.SizeOfImage >> 12) + ((v16->OptionalHeader.SizeOfImage & 0xFFF) != 0);
v21 = 8 * ((v20 >> 6) + ((v20 & 0x3F) != 0) + 2);
v22 = (unsigned int)v21;
v23 = v21 + 306;
v61 = v22;
if( v23 <= 0x132 )
goto LABEL_75;
if( v19 )
{
if( v23 + v19 <= v23 )
{
LABEL_75:
v57 = -1073741701;
goto LABEL_77;
}
v23 += v19;
}
v24 = (*(unsigned __int16 *)a2 + 7i64) & 0xFFFFFFFFFFFFFFF8ui64;
if( v23 + v24 <= v23 || (_DWORD)NumberOfSections && v23 + v24 + 4i64 * (unsigned int)NumberOfSections <= v23 + v24 )
goto LABEL_75;
LODWORD(v25) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v65 = v25;
v10 = v25;
if( !v25 )
goto LABEL_76;
v26 = (_OWORD *)a1;
v27 = *(_SECTION **)(a1 + 112);
Section = v27;
if( !v27 )
goto LABEL_14;
v28 = MiSectionControlArea(v27);
v58 = (*(_DWORD *)(*(_QWORD *)v28 + 8i64) >> 12) + (unsigned int)((*(_DWORD *)(*(_QWORD *)v28 + 8i64) & 0xFFF) != 0);
if( !(unsigned int)MiChargeResident(&MiSystemPartition, (unsigned int)v58, 0i64) )
{
LABEL_76:
v57 = -1073741670;
LABEL_77:
ExFreePoolWithTag(v12, 0);
if( v10 )
ExFreePoolWithTag(v10, 0);
return v57;
}
v26 = (_OWORD *)a1;
LABEL_14:
v29 = v10 + 10;
*((_QWORD *)v10 + 33) = 0i64;
v30 = (char *)v10 + v61 + 304;
v31 = (UINT8 *)&v30[v19];
*((_QWORD *)v10 + 34) = v10 + 19;
v32 = (_DWORD)CoverageSectionSize == 0;
*((_QWORD *)v10 + 32) = v30;
*((_QWORD *)v10 + 27) = v58;
if( !v32 )
*((_QWORD *)v10 + 28) = &v31[v24];
*v10 = *v26;
v10[1] = v26[1];
v10[2] = v26[2];
v10[3] = v26[3];
v10[4] = v26[4];
v10[5] = v26[5];
v10[6] = v26[6];
v10[7] = v26[7];
v10[8] = v26[8];
v10[9] = v26[9];
if( v16->OptionalHeader.MajorOperatingSystemVersion >= 5u && v16->OptionalHeader.MajorImageVersion >= 5u )
*((_DWORD *)v10 + 26) |= 0x8000000u;
if( (v16->OptionalHeader.DllCharacteristics & 0x80) != 0 )
*((_DWORD *)v10 + 26) |= 0x20u;
*((_QWORD *)v10 + 12) = v31;
*((_WORD *)v10 + 44) = *(_WORD *)a2;
*((_WORD *)v10 + 45) = *(_WORD *)a2;
memmove(v31, (UINT8 *)a2[1], *(unsigned __int16 *)a2);
v33 = v60;
*(_WORD *)(*((_QWORD *)v10 + 12) + 2 * ((unsigned __int64)*(unsigned __int16 *)a2 >> 1)) = 0;
*((_QWORD *)v10 + 5) = 0i64;
*(_OWORD *)((char *)v10 + 72) = v64;
if( v60 )
{
*((_DWORD *)v10 + 26) |= 0x20000000u;
*((_QWORD *)v10 + 5) = v30;
*(_DWORD *)v30 = 84302;
*((_DWORD *)v30 + 1) = v19;
*((_WORD *)v30 + 4) = v16->FileHeader.Machine;
*((_WORD *)v30 + 5) = v16->FileHeader.Characteristics;
*((_DWORD *)v30 + 3) = v16->FileHeader.TimeDateStamp;
*((_DWORD *)v30 + 4) = v16->OptionalHeader.CheckSum;
*((_DWORD *)v30 + 5) = v16->OptionalHeader.SizeOfImage;
*((_QWORD *)v30 + 3) = v13;
if( v18 )
{
memmove((UINT8 *)v30 + 32, v18, v63->Size);
v47 = v63->Size;
v59 = 0;
v48 = 0;
if( v47 / 0x1C )
{
v49 = 0i64;
v62 = 0i64;
v50 = (unsigned int *)(v18 + 16);
do
{
v51 = v50[1];
v52 = *v50;
LODWORD(CoverageSectionSize) = v47;
if( (_DWORD)v51
&& (v53 = v16->OptionalHeader.SizeOfImage, (unsigned int)v51 < v53)
&& (unsigned int)v51 + v52 > (unsigned int)v51
&& (unsigned int)v51 + v52 < v53 )
{
memmove((UINT8 *)&v30[(unsigned int)v47 + 32], (UINT8 *)(v13 + v51), v52);
v49 = v62;
LODWORD(v47) = v52 + v47;
v48 = v59;
}
else
{
LODWORD(CoverageSectionSize) = 0;
}
++v48;
v54 = 28 * v49;
v49 = v48;
v50 += 7;
v59 = v48;
v62 = v48;
*(_DWORD *)&v30[v54 + 52] = CoverageSectionSize;
v55 = v63->Size * (unsigned __int128)0x2492492492492493ui64;
}
while( v48 < (*((_QWORD *)&v55 + 1) + (((unsigned __int64)v63->Size - *((_QWORD *)&v55 + 1)) >> 1)) >> 4 );
v10 = v65;
v33 = v60;
v29 = v65 + 10;
}
}
}
*((_QWORD *)v10 + 7) = v13 + v16->OptionalHeader.AddressOfEntryPoint;
*((_DWORD *)v10 + 30) = v16->OptionalHeader.CheckSum;
if( Section )
{
v34 = MiSectionControlArea(Section);
v35 = *((_WORD *)v10 + 55) & 0xFFF0 | (*(_BYTE *)(*(_QWORD *)v34 + 15i64) >> 4);
*((_WORD *)v10 + 55) = v35;
*((_WORD *)v10 + 55) = v35 & 0xFF8F | (16 * ((*(_BYTE *)(*(_QWORD *)v34 + 15i64) >> 1) & 7));
}
else
{
v34 = 0i64;
}
*((_DWORD *)v10 + 38) = v16->OptionalHeader.SizeOfImage;
*((_DWORD *)v10 + 39) = v16->FileHeader.TimeDateStamp;
MiCaptureImageExceptionValues((__int64)v10);
MiLockdownSections((__int64)v10);
if( Section )
v36 = *(unsigned int *)(*(_QWORD *)v34 + 8i64);
else
v36 = (unsigned __int64)*((unsigned int *)v10 + 16) >> 12;
if( v33 )
goto LABEL_29;
*((_QWORD *)v29 + 5) = v36;
*((_QWORD *)v29 + 6) = v36;
if( v13 == PsNtosImageBase )
goto LABEL_69;
if( (PVOID)v13 == PsHalImageBase )
{
if( v13 != PsNtosImageBase )
{
v56 = v36 - MxHalFreedGapCharges;
goto LABEL_70;
}
LABEL_69:
v56 = v36 - MxKernelFreedGapCharges;
LABEL_70:
*((_QWORD *)v29 + 5) = v56;
}
LABEL_29:
if( !a5 )
*((_DWORD *)v29 + 9) |= 1u;
if( (dword_140CFA174 & 1) != 0 || (v72 & 2) != 0 )
*((_DWORD *)v29 + 9) |= 0x10u;
*((_QWORD *)v10 + 16) = 0i64;
LODWORD(CoverageSectionSize) = 0;
if( ExCovMaxPagedPoolToUse )
{
SectionInfo = ExpCovGetSectionInfo(*((VOID **)v10 + 6), &CoverageSectionSize);
if( SectionInfo )
{
*((_DWORD *)v10 + 31) = CoverageSectionSize;
*((_QWORD *)v10 + 16) = SectionInfo;
DbgPrintEx(0x7Eu, 2u, (PCSTR)&stru_1407D9AB0.R13, v10);
ExCovReadjustUnloadedModuleEntry((__int64)v10, 1);
}
}
MiProcessLoaderEntry((__int64 *)v10, 1);
if( !v33 )
{
if( Section )
{
*((_DWORD *)v29 + 8) = -2;
*((_QWORD *)v29 + 2) = v13 | 3;
*((_QWORD *)v29 + 3) = (v36 << 12) + v13 - 1;
v67 = v34;
MiManageSubsectionView(&v67, v29, 3i64);
}
}
*a6 = (__int64)v10;
return 0i64;
}Referenced by:
MiApplyHotPatchToLoadedDriver
MiInitializeLoadedModuleList
MmLoadSystemImageEx