MiHotPatchImage

VOID __fastcall MiHotPatchImage(INT64 a1, INT64 rdx0, WCHAR r8_0, INT64 r9_0){
  UINT64 v4; 
  _ETHREAD *CurrentThread; 
  struct _EX_RUNDOWN_REF *v6; 
  int v7; 
  _QWORD *ProcessHotPatchContext; 
  int v9; 
  int v10; 
  int v11; 
  unsigned int v12; 
  INT64 HotPatchEntry; 
  __int64 v14; 
  INT64 v15; 
  int v16; 
  struct _UNICODE_STRING v17; 
  int v18; 
  WCHAR v19; 
  int v20; 
  INT64 a7; 
  INT64 a7a; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  struct _UNICODE_STRING DestinationString; 
  int v27; 
  INT64 a5; 
  _ETHREAD *v29; 
  struct _EX_RUNDOWN_REF *v30; 
  PEX_RUNDOWN_REF RunRef; 
  struct _UNICODE_STRING v32; 
  INT64 a4; 
  INT64 v34; 
  INT64 a2; 
  INT64 a3; 
  char v37; 
  int v38; 
  LODWORD(a2) = r9_0;
  v34 = rdx0;
  a4 = a1;
  v25 = 0i64;
  a5 = 0i64;
  DestinationString = 0i64;
  v4 = r8_0;
  RtlInitUnicodeString(&DestinationString, 0i64, r8_0);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v29 = CurrentThread;
  v6 = (struct _EX_RUNDOWN_REF *)*((_QWORD *)CurrentThread + 23);
  v30 = v6;
  RunRef = v6 + 139;
  if( ExAcquireRundownProtection(v6 + 139) )
  {
    v7 = v38;
    ProcessHotPatchContext = 0i64;
    v9 = 1;
    while( 1 )
    {
      MiFindProcessImageHotPatchRecord();
      LODWORD(a4) = v10;
      v11 = v10;
      if( v10 >= 0 )
      {
        v12 = v25;
      }
      else
      {
        if( v10 != -1073741275 )
          goto LABEL_26;
        if( v7 || !MiGetProcessHotPatchContext((INT64)v6, 0i64) )
        {
          v11 = 1075380276;
LABEL_25:
          v9 = 0;
          goto LABEL_26;
        }
        v12 = 0;
        LODWORD(v25) = 0;
      }
      if( !ProcessHotPatchContext )
      {
        ProcessHotPatchContext = MiGetProcessHotPatchContext((INT64)v6, 1i64);
        if( !ProcessHotPatchContext )
        {
          v11 = -1073741670;
          goto LABEL_26;
        }
      }
      HotPatchEntry = MiGetHotPatchEntry((UINT64)ProcessHotPatchContext, v4, v12, &a4);
      v15 = HotPatchEntry;
      if( !HotPatchEntry )
        break;
      LOBYTE(v24) = v37;
      LODWORD(v23) = a3;
      LODWORD(a7) = a2;
      HIDWORD(v25) = 1;
      v16 = MiPerformImageHotPatch(
              (INT64)ProcessHotPatchContext,
              HotPatchEntry,
              v14,
              v34,
              v4,
              &DestinationString,
              a7,
              v23,
              v24,
              &a5);
      LODWORD(a4) = v16;
      --*((_WORD *)CurrentThread + 243);
      ExAcquirePushLockExclusiveEx((UINT64)(ProcessHotPatchContext + 2), 0i64);
      LODWORD(a7a) = v16;
      MiLogHotPatchOperation(v15, (unsigned int)a2, (unsigned int)a3, v12, &a5, &DestinationString.Length, a7a);
      *(_DWORD *)(v15 + 92) &= ~1u;
      v27 = *(_DWORD *)(v15 + 92);
      if( v16 < 0 )
      {
        LOBYTE(v18) = v27;
      }
      else
      {
        v17 = *(struct _UNICODE_STRING *)(v15 + 64);
        *(_DWORD *)(v15 + 48) = a2;
        *(_DWORD *)(v15 + 52) = a3;
        *(_QWORD *)(v15 + 80) = a5;
        *(_DWORD *)(v15 + 88) = v12;
        *(struct _UNICODE_STRING *)(v15 + 64) = DestinationString;
        DestinationString = v17;
        v18 = *(_DWORD *)(v15 + 92);
        v32 = v17;
      }
      if( (_InterlockedExchangeAdd64(ProcessHotPatchContext + 2, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(ProcessHotPatchContext + 2);
      KeAbPostRelease(ProcessHotPatchContext + 2);
      CurrentThread = v29;
      KiLeaveGuardedRegionUnsafe((__int64)v29);
      v11 = a4;
      if( (int)a4 < 0 )
        goto LABEL_25;
      if( (v18 & 2) != 0 )
      {
        MiDeleteHotPatchEntry((PVOID)v15);
        HIDWORD(v25) = 0;
        goto LABEL_25;
      }
      v7 = 0;
      RtlFreeAnsiString(&DestinationString);
      RtlInitUnicodeString(&DestinationString, 0i64, v19);
      v6 = v30;
    }
    v11 = a4;
    if( (int)a4 >= 0 && (_DWORD)a4 != 259 )
      goto LABEL_25;
LABEL_26:
    if( HIDWORD(v25) )
    {
      MiLockVadShared((INT64)CurrentThread, v4);
      v20 = MiVadDeleted(v4);
      MiUnlockVadShared((INT64)CurrentThread, v4);
      if( v20 )
        MiDeleteImageHotPatchState(v4);
    }
    if( v9 )
      MiLogHotPatchOperationStatus(a2, a3, (__int128 *)&DestinationString, v11, 0);
    ExReleaseRundownProtection(RunRef);
  }
  RtlFreeAnsiString(&DestinationString);
}

Referenced by: