MiLockdownSections
__int64 __fastcall MiLockdownSections(__int64 a1){
void *v1;
INT64 v2;
int v3;
__int64 result;
int v5;
IMAGE_NT_HEADERS *v6;
__int64 v7;
int NumberOfSections;
RTL_BITMAP *v9;
_DWORD *v10;
int v11;
int v12;
unsigned int v13;
v1 = *(void **)(a1 + 48);
v2 = a1 + 160;
v3 = 0;
if( (MiFlags & 0x10000) != 0 && (!*(_QWORD *)(a1 + 112) || (*(_DWORD *)(a1 + 196) & 2) != 0) )
v3 = 2;
result = MiGetSystemRegionType(*(_QWORD *)(a1 + 48));
v5 = v3 | 1;
if( (_DWORD)result == 1 )
v5 = v3;
if( v5 )
{
v6 = RtlImageNtHeader(v1);
v7 = v6->FileHeader.SizeOfOptionalHeader + 60i64;
MiLockLoaderEntry(v2, 0i64);
NumberOfSections = v6->FileHeader.NumberOfSections;
v9 = *(RTL_BITMAP **)(v2 + 112);
if( v6->FileHeader.NumberOfSections )
{
v10 = (unsigned int *)((char *)&v6->Signature + v7);
do
{
v11 = 0;
if( *(v10 - 9) == 1987011374 && *((_WORD *)v10 - 16) == 29285 )
v11 = 1;
v12 = v11 | 2;
if( (*v10 & 0x20000000) == 0 )
v12 = v11;
if( (v12 & v5) != 0 )
{
v13 = *(v10 - 5);
if( v13 < *(v10 - 7) )
v13 = *(v10 - 7);
RtlSetBits(
v9,
*(v10 - 6) >> 12,
((((unsigned __int64)v1 + *(v10 - 6) + v13 + 4095) & 0xFFFFFFFFFFFFF000ui64)
- ((unsigned __int64)v1
+ (unsigned int)*(v10 - 6))) >> 12);
}
--NumberOfSections;
v10 += 10;
}
while( NumberOfSections > 0 );
}
return MiUnlockLoaderEntry(v2, 0i64);
}
return result;
}Referenced by:
MiConstructLoaderEntry
MiInitializeLoadedModuleList