MiLogHotPatchOperationStatus
char __fastcall MiLogHotPatchOperationStatus(int a1, int a2, __int128 *a3, int a4, int a5){
void **v5;
unsigned __int16 *p_DestinationString;
__int64 v10;
_EPROCESS *v11;
__int64 v12;
__int64 v13;
ULONG v14;
__int64 v15;
unsigned __int8 *v16;
__int64 *v17;
int v19;
int v20;
unsigned int ProcessId;
int v22;
int v23;
int v24;
int v25;
int v26;
int v27;
int v28;
int v29;
int v30;
CHAR *ImageFileName;
UINT Key[2];
__int64 v33;
__int64 v34;
__int64 v35;
struct _UNICODE_STRING DestinationString;
__int64 v37[13];
int v38[2];
__int64 *v39;
__int64 v40;
char v41;
int *v42;
__int64 v43;
int *v44;
__int64 v45;
int *v46;
__int64 v47;
int *v48;
__int64 v49;
__int64 v50;
int v51[2];
__int64 *v52;
__int64 v53;
char v54[32];
unsigned int *p_ProcessId;
__int64 v56;
char v57[16];
int *v58;
__int64 v59;
int *v60;
__int64 v61;
int *v62;
__int64 v63;
int *v64;
__int64 v65;
__int64 v66;
int v67[2];
__int64 *v68;
__int64 v69;
void *retaddr;
v5 = &retaddr;
p_DestinationString = (unsigned __int16 *)a3;
ImageFileName = 0i64;
DestinationString = 0i64;
if( *(_QWORD *)&qword_140C4EC20 )
{
if( !a3 )
{
RtlInitUnicodeString(&DestinationString, 0i64, 0);
p_DestinationString = (unsigned __int16 *)&DestinationString;
}
LOBYTE(v5) = a5;
if( a5 )
{
if( a5 == 1 )
{
if( **(_DWORD **)&qword_140C4EC20 <= 5u )
return(char)v5;
LOBYTE(v5) = tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 0x400000000020i64);
if( !(_BYTE)v5 )
return(char)v5;
v25 = a4;
v37[4] = (__int64)&v25;
v16 = (unsigned __int8 *)&unk_140025520;
v37[5] = 4i64;
v37[6] = (__int64)&v26;
v37[8] = (__int64)&v27;
v37[10] = (__int64)v38;
v37[12] = *((_QWORD *)p_DestinationString + 1);
v38[0] = *p_DestinationString;
v34 = 2164260864i64;
v39 = &v34;
v17 = v37;
v26 = a1;
v37[7] = 4i64;
v27 = a2;
v37[9] = 4i64;
v37[11] = 2i64;
v38[1] = 0;
v40 = 8i64;
}
else
{
if( **(_DWORD **)&qword_140C4EC20 <= 5u )
return(char)v5;
LOBYTE(v5) = tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 0x400000000020i64);
if( !(_BYTE)v5 )
return(char)v5;
v28 = a4;
v42 = &v28;
v16 = (unsigned __int8 *)&byte_140025593;
v43 = 4i64;
v44 = &v29;
v46 = &v30;
v48 = v51;
v50 = *((_QWORD *)p_DestinationString + 1);
v51[0] = *p_DestinationString;
v35 = 2164260864i64;
v52 = &v35;
v17 = (__int64 *)&v41;
v29 = a1;
v45 = 4i64;
v30 = a2;
v47 = 4i64;
v49 = 2i64;
v51[1] = 0;
v53 = 8i64;
}
LOBYTE(v5) = tlgWriteEx_EtwWriteEx(v15, v16, v13, v14, v19, v20, 8u, (__int64)v17);
return(char)v5;
}
MiFillLogProcessInfo((_MMSUPPORT_INSTANCE *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1664i64), Key, &ImageFileName);
v10 = *(_QWORD *)&qword_140C4EC20;
if( **(_DWORD **)&qword_140C4EC20 > 5u )
{
LOBYTE(v5) = tlgKeywordOn(*(__int64 *)&qword_140C4EC20, 0x400000000020i64);
if( (_BYTE)v5 )
{
ProcessId = (unsigned int)PsGetProcessId((PEPROCESS)v11);
p_ProcessId = &ProcessId;
v56 = 4i64;
tlgCreate1Sz_char((__int64)v57, ImageFileName);
v22 = a4;
v58 = &v22;
v59 = 4i64;
v60 = &v23;
v23 = a1;
v62 = &v24;
v61 = 4i64;
v64 = v67;
v66 = *((_QWORD *)p_DestinationString + 1);
v67[0] = *p_DestinationString;
v33 = 2164260864i64;
v68 = &v33;
v24 = a2;
v63 = 4i64;
v65 = 2i64;
v67[1] = 0;
v69 = 8i64;
LOBYTE(v5) = tlgWriteEx_EtwWriteEx(
v10,
(unsigned __int8 *)byte_140025495,
v12,
1u,
v19,
v20,
0xAu,
(__int64)v54);
}
}
}
return(char)v5;
}Referenced by:
MiApplyHotPatchToDriver
MiHotPatchImage
MiLoadHotPatch
MiUnloadHotPatch
MmRegisterHotPatch