MmEnumerateSystemImages

__int64 __fastcall MmEnumerateSystemImages(__int64 (__fastcall *a1)(PVOID *, __int64), __int64 a2){
  int v2; 
  __int64 v5; 
  __int64 v6; 
  _ETHREAD *Lock; 
  BOOL v8; 
  PVOID *v9; 
  PVOID v10; 
  struct _DMA_ADAPTER *v11; 
  struct _DMA_ADAPTER *i; 
  struct _DMA_ADAPTER *v14; 
  KAPC_STATE ApcState; 
  v2 = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  v5 = *((_QWORD *)KeGetCurrentThread() + 23);
  if( (*(_DWORD *)(v5 + 2172) & 0x1000) != 0 )
    v6 = 0i64;
  else
    v6 = *(_QWORD *)(v5 + 1368);
  Lock = MmAcquireLoadLock();
  --*((_WORD *)Lock + 242);
  LOBYTE(v8) = 1;
  ExAcquireResourceSharedLite(&PsLoadedModuleResource, v8);
  v9 = (PVOID *)PsLoadedModuleList;
  do
  {
    v10 = v9[6];
    v11 = 0i64;
    if( (unsigned int)MmIsSessionAddress(v10) == 1 && (!v6 || !MiSessionLookupImage((UINT64)v10)) )
    {
      for( i = 0i64; ; i = v11 )
      {
        LODWORD(v14) = MmGetNextSession(i);
        v11 = v14;
        if( !v14 )
          break;
        if( MmAttachSession(v14, &ApcState) >= 0 )
        {
          if( MiSessionLookupImage((UINT64)v10) )
            goto LABEL_5;
          MmDetachSession(v11, &ApcState);
        }
      }
      goto LABEL_8;
    }
LABEL_5:
    v2 = a1(v9, a2);
    if( v11 )
    {
      MmDetachSession(v11, &ApcState);
      HalPutDmaAdapter(v11);
    }
    if( v2 < 0 )
      break;
LABEL_8:
    v9 = (PVOID *)*v9;
  }
  while( v9 != &PsLoadedModuleList );
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread((__int64)Lock);
  MmReleaseLoadLock(Lock);
  return(unsigned int)v2;
}

Referenced by: