MiMarkKernelCfgAddressTakenImports
NTSTATUS __fastcall MiMarkKernelCfgAddressTakenImports(__int64 a1){
_DWORD *v2;
__int64 v3;
unsigned int v4;
unsigned int v5;
unsigned int *v6;
unsigned int v7;
__int64 v8;
NTSTATUS result;
UINT64 v10;
v2 = RtlImageDirectoryEntryToData(*(VOID **)(a1 + 48), 1u, 0xAu, &v10);
v3 = *(_QWORD *)(a1 + 48);
v4 = 0;
v5 = v2[42];
v6 = (unsigned int *)*((_QWORD *)v2 + 20);
v7 = (v2[36] >> 28) + 4;
if( v5 )
{
while( 1 )
{
v8 = *v6;
if( (unsigned int)v8 > *(_DWORD *)(a1 + 64) - 8 || (v8 & 7) != 0 )
return -1073741701;
result = MiMarkKernelCfgTarget(*(_QWORD *)(v8 + v3));
if( result < 0 )
return result;
++v4;
v6 = (unsigned int *)((char *)v6 + v7);
if( v4 >= v5 )
goto LABEL_6;
}
}
else
{
LABEL_6:
*(_DWORD *)(a1 + 104) |= 0x100u;
return 0;
}
}Referenced by:
MiProcessKernelCfgAddressTakenImports