MiSelectImageBase

__int64 __fastcall MiSelectImageBase(__int64 a1, __int64 a2, int a3, int a4, __int64 *a5){
  INT64 v5; 
  int v6; 
  int v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  unsigned int v12; 
  unsigned __int64 v13; 
  __int64 v14; 
  UINT64 v15; 
  unsigned int v16; 
  bool v17; 
  UINT64 v18; 
  UINT64 v19; 
  __int64 v20; 
  int v21; 
  int ImageWowSubsystemIndex; 
  unsigned __int64 v24; 
  INT64 v25; 
  unsigned __int64 v26; 
  unsigned int v27; 
  UINT64 Bias; 
  RTL_BITMAP *Bitmap[2]; 
  __int64 v30; 
  unsigned int v31; 
  v31 = a3;
  v5 = *(_QWORD *)a1;
  v6 = 0;
  v8 = a4;
  Bias = 0i64;
  v9 = *(_QWORD *)(a1 + 56);
  v10 = a2;
  v11 = 0i64;
  v30 = v9;
  if( (*(_BYTE *)(a1 + 14) & 0x40) == 0 )
  {
    if( (*(_BYTE *)(v9 + 51) & 0x10) != 0 && (*(_WORD *)(v9 + 44) & 0x2000) != 0 )
    {
      v12 = 2;
      goto LABEL_6;
    }
    if( *(_QWORD *)(a1 + 32) < 0x100000000ui64 )
    {
      v12 = 1;
LABEL_6:
      *(_DWORD *)(v5 + 92) ^= (*(_DWORD *)(v5 + 92) ^ (v12 << 20)) & 0x300000;
      v9 = *(_QWORD *)(a1 + 56);
      v30 = v9;
      goto LABEL_7;
    }
    v12 = 0;
LABEL_5:
    v30 = v9;
    if( v12 == 4 )
      goto LABEL_7;
    goto LABEL_6;
  }
  ImageWowSubsystemIndex = MiGetImageWowSubsystemIndex(a1);
  if( ImageWowSubsystemIndex != -1 )
  {
    v12 = ImageWowSubsystemIndex + 3;
    goto LABEL_5;
  }
  v12 = 4;
LABEL_7:
  LODWORD(v13) = *(_DWORD *)(a1 + 8);
  if( !a3 )
  {
    if( !dword_140C4C9F0 )
      goto LABEL_9;
    v27 = ((unsigned int)MiUserHotPatchReserveSize >> 12) + ((MiUserHotPatchReserveSize & 0xFFF) != 0);
    if( !v27 )
      goto LABEL_9;
    if( v27 + (unsigned int)v13 >= (unsigned int)v13 )
    {
      LODWORD(v13) = v27 + v13;
      goto LABEL_9;
    }
    return 3221225503i64;
  }
  LOBYTE(v24) = MiBytesToMapSystemImage((_FAST_MUTEX *)(unsigned int)((_DWORD)v13 << 12));
  if( !v24 )
    return 3221225503i64;
  a3 = v31;
  v13 = v24 >> 12;
LABEL_9:
  v14 = -1i64;
  if( v8 == 1 )
  {
    LOWORD(v16) = 0;
    v11 = *(_QWORD *)(a1 + 32);
    goto LABEL_27;
  }
  v15 = *(_QWORD *)(a1 + 32) - *(_QWORD *)(v10 + 40);
  v16 = (unsigned int)(v13 + 15) >> 4;
  if( !a3 )
  {
    if( (*(_WORD *)(v9 + 44) & 0x2000) != 0 )
    {
      *(_OWORD *)Bitmap = 0i64;
      v17 = v12 != 4;
      if( dword_140CFA190 && MiImageCanUseHighOverflowArea(a1, v15) )
        v17 = 0;
      if( v17 )
      {
        MiGetImageBitMapInfo((RTL_BITMAP **)v12, (UINT64 *)Bitmap, &Bias);
        MiSelectRelocationStartHint(Bitmap, v16, 0i64, 0i64);
        v14 = v18;
        if( v18 == -1i64 )
        {
          v9 = v30;
        }
        else
        {
          MiObtainRelocationBits(Bitmap, v16, v18, v19);
          v9 = v30;
          v14 = v20;
          if( v20 != -1 )
            v11 = Bias - ((v20 + (unsigned __int16)v16) << 16);
        }
      }
    }
    if( v14 != -1 )
      goto LABEL_18;
    v21 = *(_DWORD *)(v5 + 92);
    if( (v21 & 0x800000) != 0 )
    {
      v11 = *(_QWORD *)(a1 + 32);
      v6 = 1;
      goto LABEL_20;
    }
    if( v12 )
    {
      if( (*(_WORD *)(v9 + 44) & 0x2000) != 0 )
      {
        v11 = MiSelectOverflowDllBase(a1, v15);
      }
      else
      {
        v26 = (unsigned __int64)(unsigned __int8)ExGenRandom(1i64) << 16;
        v11 = v15 - v26;
        if( v15 < 0x1000000 )
          v11 = v26 + 0x10000;
      }
    }
    else
    {
      v11 = ((unsigned int)ExGenRandom(1i64) % (131073i64 - (unsigned __int16)v16) + 2146828288) << 16;
    }
LABEL_27:
    v6 = 1;
LABEL_18:
    *(_DWORD *)(v5 + 88) = v14;
    *(_WORD *)(v5 + 92) = v16;
LABEL_19:
    v21 = *(_DWORD *)(v5 + 92);
LABEL_20:
    *(_DWORD *)(v5 + 92) = (v6 << 23) | v21 & 0xFF7FFFFF;
    *a5 = v11;
    return 0i64;
  }
  v25 = MiSelectSystemImageAddress((unsigned int)a3, (unsigned int)v13);
  v11 = v25;
  if( v25 )
  {
    *(_WORD *)(v5 + 92) = v16;
    *(_DWORD *)(v5 + 88) = (unsigned __int64)(v25 + 0x800000000000i64) >> 16;
    MiSetControlAreaSystemVa(v5, v31);
    goto LABEL_19;
  }
  return 3221225626i64;
}

Referenced by: