MiMarkKernelCfgAddressTakenImports

NTSTATUS __fastcall MiMarkKernelCfgAddressTakenImports(__int64 a1){
  _DWORD *v2; 
  __int64 v3; 
  unsigned int v4; 
  unsigned int v5; 
  unsigned int *v6; 
  unsigned int v7; 
  __int64 v8; 
  NTSTATUS result; 
  UINT64 v10; 

  v2 = RtlImageDirectoryEntryToData(*(VOID **)(a1 + 48), 1u, 0xAu, &v10);
  v3 = *(_QWORD *)(a1 + 48);
  v4 = 0;
  v5 = v2[42];
  v6 = (unsigned int *)*((_QWORD *)v2 + 20);
  v7 = (v2[36] >> 28) + 4;
  if( v5 )
  {
    while( 1 )
    {
      v8 = *v6;
      if( (unsigned int)v8 > *(_DWORD *)(a1 + 64) - 8 || (v8 & 7) != 0 )
        return -1073741701;
      result = MiMarkKernelCfgTarget(*(_QWORD *)(v8 + v3));
      if( result < 0 )
        return result;
      ++v4;
      v6 = (unsigned int *)((char *)v6 + v7);
      if( v4 >= v5 )
        goto LABEL_6;
    }
  }
  else
  {
LABEL_6:
    *(_DWORD *)(a1 + 104) |= 0x100u;
    return 0;
  }
}

Referenced by:

MiProcessKernelCfgAddressTakenImports