MiMarkKernelImageCfgBits

__int64 __fastcall MiMarkKernelImageCfgBits(__int64 a1, __int64 a2){
  int KernelCfgBitmapPageTables; 
  _ETHREAD *CurrentThread; 
  UINT64 v6; 
  INT64 v7; 
  unsigned int v8; 
  __int64 v9; 
  __int64 v10; 
  unsigned int v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  ULONG Size[2]; 
  char *v15; 
  char *v16; 
  UINT64 v17[2]; 
  int v18; 
  __int64 v19; 
  int v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  __int64 v24; 
  INT64 result[14]; 
  v16 = 0i64;
  v19 = 0i64;
  v20 = 0;
  v22 = 0i64;
  v24 = 0i64;
  v15 = 0i64;
  Size[0] = 0;
  if( a2 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 243);
    ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C980, 0i64);
    KernelCfgBitmapPageTables = MiAllocateKernelCfgBitmapPageTables(*(_QWORD *)(a1 + 48), *(unsigned int *)(a1 + 64));
    MiReleaseKernelCfgLock();
    if( KernelCfgBitmapPageTables >= 0 )
    {
      v6 = *(unsigned int *)(a1 + 64);
      v7 = *(_QWORD *)(a1 + 48);
      v8 = *(_DWORD *)(a1 + 64);
      v17[0] = a1;
      v17[1] = 0i64;
      v21 = 0i64;
      v23 = 0i64;
      v18 = (v8 >> 12) + ((v6 & 0xFFF) != 0);
      KernelCfgBitmapPageTables = VslCompleteSecureDriverLoad(*(_QWORD *)(a1 + 112), v7, v6);
      MiUnlockDriverPages(v17);
      if( KernelCfgBitmapPageTables >= 0 )
      {
        LODWORD(v9) = RtlImageDirectoryEntryToData(*(PVOID *)(a1 + 48), 1u, 0xAu, (UINT64 *)Size);
        v10 = v9;
        if( v9 && Size[0] >= 0xB0 && *(_QWORD *)(v9 + 168) )
        {
          v11 = 0;
          while( 1 )
          {
            v11 = MiSnapDriverRange(a1, v11, 2, 0i64, &v15, &v16);
            if( v15 )
            {
              v12 = *(_QWORD *)(v10 + 160);
              v13 = (_QWORD)MmGetPteBase() << 25;
              if( v12 >= (((_QWORD)v15 << 25) - v13) >> 16 && v12 <= ((((_QWORD)v16 << 25) - v13) | 0xFFF0000) >> 16 )
                break;
            }
            if( !v11 )
              return(unsigned int)KernelCfgBitmapPageTables;
          }
          *(_DWORD *)(a1 + 104) |= 0x800u;
        }
        else
        {
          *(_DWORD *)(a1 + 104) |= 0x100u;
        }
      }
    }
  }
  else if( (MiFlags & 0x8000) != 0 )
  {
    memset((INT64)result, 0i64);
    result[1] = *(_QWORD *)(a1 + 48);
    KernelCfgBitmapPageTables = VslpEnterIumSecureMode(2u, 217, 0i64, (INT64)result);
    if( (MiFlags & 0x80000) != 0 )
      MiFlushKernelCfgBitmap(*(_QWORD *)(a1 + 48), *(unsigned int *)(a1 + 64));
  }
  else
  {
    return 0;
  }
  return(unsigned int)KernelCfgBitmapPageTables;
}

Referenced by: