MiProtectSystemImage

VOID __stdcall MiProtectSystemImage(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  char *DllBase; 
  __int64 v3; 
  __int64 v4; 
  int v5; 
  __int64 v6; 
  int v7; 
  __int128 *v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  int *v11; 
  char *v12; 
  int v13; 
  char *v14; 
  _MMPTE *v15; 
  _MMPTE *v16; 
  int v17; 
  char *v18; 
  unsigned int v19; 
  _MMPTE *v20; 
  unsigned int v21; 
  VOID *v22; 
  UINT64 v23; 
  unsigned int v24; 
  _MMPTE *v25; 
  int v26; 
  unsigned int v27; 
  unsigned __int64 v28; 
  _MMPTE *v29; 
  UINT64 v30; 
  _MMPTE *v31; 
  _MMPTE *v32; 
  _MMPTE *v33; 
  __int64 v34; 
  __int64 v35; 
  __int64 v36; 
  unsigned int v37; 
  _MMPTE *v38; 
  unsigned int SectionProtection; 
  unsigned int SectionProtection_4; 
  unsigned int v41; 
  int v42; 
  _MMPTE *PteAddress; 
  _MMPTE *v44; 
  unsigned __int64 v45; 
  char *v47; 
  __int128 v48[2]; 
  __int64 v49; 

  DllBase = (char *)DataTableEntry->DllBase;
  memset(v48, 0, sizeof(v48));
  v49 = 0i64;
  if( MI_IS_PHYSICAL_ADDRESS(DllBase) )
  {
    if( DllBase == (char *)PsNtosImageBase || DllBase == PsHalImageBase )
      MiActOnLargeKernelHalPages(
        (unsigned __int64)DllBase,
        (__int64(__fastcall *)(unsigned __int64, unsigned __int64))MiProtectLargeKernelHalRange);
  }
  else
  {
    LODWORD(v3) = RtlImageNtHeader((UINT64)DllBase);
    SectionProtection_4 = 0;
    v4 = v3;
    v5 = 0;
    if( MiGetSystemRegionType((UINT64)DllBase) == 1 )
    {
      SectionProtection_4 = 1;
    }
    else if( (DataTableEntry->Flags & 0x8000000) == 0 )
    {
      v5 = 1;
    }
    v6 = *(unsigned __int16 *)(v4 + 6);
    v7 = *(unsigned __int16 *)(v4 + 6);
    v8 = (__int128 *)(v4 + *(unsigned __int16 *)(v4 + 20) + 24i64);
    v9 = (*(_DWORD *)(v4 + 80) >> 12) + (unsigned int)((*(_DWORD *)(v4 + 80) & 0xFFF) != 0);
    v10 = (unsigned __int64)DllBase;
    if( *(_WORD *)(v4 + 6) )
    {
      v11 = (int *)(v8 + 1);
      while( 1 )
      {
        v12 = &DllBase[*(v11 - 1)];
        if( (unsigned __int64)v12 < v10 )
          break;
        v13 = *v11;
        if( *v11 < (unsigned int)*(v11 - 2) )
          v13 = *(v11 - 2);
        v11 += 10;
        v10 = -(__int64)*(unsigned int *)(v4 + 56) & (unsigned __int64)&v12[*(unsigned int *)(v4 + 56) - 1 + v13];
        if( !--v7 )
          goto LABEL_11;
      }
    }
    else
    {
LABEL_11:
      v42 = -1073741824;
      v47 = (char *)v8 + 40 * v6 - 1;
      PteAddress = MiGetPteAddress(DllBase);
      SectionProtection = 0;
      v15 = &PteAddress[v9];
      v16 = 0i64;
      v44 = 0i64;
      v17 = v6 + 1;
      v45 = (unsigned __int64)v15;
      do
      {
        if( v17 == 1 )
        {
          HIDWORD(v49) = 0;
          v8 = v48;
          v18 = 0i64;
          v41 = 0;
          v20 = MiGetPteAddress(v14) + 1;
        }
        else
        {
          v18 = &DllBase[*((unsigned int *)v8 + 3)];
          v20 = MiGetPteAddress(v18);
          if( v21 < v19 )
            v21 = v19;
          v23 = SectionProtection;
          v41 = v21;
        }
        if( v16 && v20 > v16 )
        {
          v37 = MiComputeDriverProtection(SectionProtection_4, v23);
          MiSetSystemCodeProtection(DataTableEntry, v16, v16, v37);
          v22 = v47;
          v38 = PteAddress + 1;
          if( v16 != PteAddress )
            v38 = PteAddress;
          PteAddress = v38;
          v44 = 0i64;
          SectionProtection = 0;
        }
        if( (unsigned __int64)v20 >= v45 && v8 != v48 )
          break;
        v24 = *((_DWORD *)v8 + 9) & 0xE0000000;
        if( v5 == 1 && ((MiFlags & 0x10000) == 0 || (*((_DWORD *)v8 + 9) & 0x20000000) == 0) )
          v24 = *((_DWORD *)v8 + 9) & 0x60000000 | 0x80000000;
        if( v24 == v42 && (v36 = *(unsigned int *)(v4 + 56), (unsigned int)v36 <= 0x1000) )
        {
          v34 = (unsigned int)v36;
          v35 = v36 + v41 - 1i64;
        }
        else
        {
          v25 = MiGetPteAddress(v22);
          v29 = v25;
          if( v25 == v20 )
          {
            v44 = v20;
            v29 = v25 - 1;
            SectionProtection = v27 | v24 | v26;
          }
          if( (unsigned __int64)v29 >= v28 )
          {
            v30 = (unsigned int)MiComputeDriverProtection(SectionProtection_4, v27);
            v33 = (_MMPTE *)(v45 - 8);
            if( (unsigned __int64)v31 < v45 )
              v33 = v31;
            MiSetSystemCodeProtection(DataTableEntry, v32, v33, v30);
          }
          v34 = *(unsigned int *)(v4 + 56);
          v35 = v34 + v41 - 1i64;
          PteAddress = v20;
          v42 = v24;
        }
        v16 = v44;
        v8 = (__int128 *)((char *)v8 + 40);
        v14 = (char *)((-v34 & (unsigned __int64)&v18[v35]) - 1);
        v47 = v14;
        --v17;
      }
      while( v17 );
    }
  }
}

Referenced by: