MiSelectImageBase

VOID __fastcall MiSelectImageBase(
        _MI_DYNAMIC_RELOCATIONS *DynamicRelocations,
        _SEGMENT *Segment,
        _MI_RELOCATION_IMAGE_SPACE RelocationImageType,
        UINT64 MakeDiffZero){
  _CONTROL_AREA *v4; 
  int v5; 
  int v7; 
  __int64 v8; 
  _SEGMENT *v9; 
  __int64 v10; 
  unsigned int v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  UINT64 v14; 
  unsigned int v15; 
  bool v16; 
  UINT64 v17; 
  UINT64 v18; 
  __int64 v19; 
  volatile int WritableUserReferences; 
  NTSTATUS ImageWowSubsystemIndex; 
  unsigned __int64 v22; 
  VOID *v23; 
  unsigned __int64 v24; 
  unsigned int v25; 
  int v26; 
  __int64 v27; 
  UINT64 StartBit; 
  UINT64 Bias; 
  UINT64 HighVa[2]; 
  __int64 v31; 
  _MI_RELOCATION_IMAGE_SPACE RelocationImageTypea; 
  __int64 *v33; 

  RelocationImageTypea = RelocationImageType;
  v4 = *(_CONTROL_AREA **)DynamicRelocations;
  v5 = 0;
  StartBit = 0i64;
  v7 = MakeDiffZero;
  Bias = 0i64;
  v8 = *((_QWORD *)DynamicRelocations + 7);
  v9 = Segment;
  v10 = 0i64;
  v31 = v8;
  if( (*((_BYTE *)DynamicRelocations + 14) & 0x40) == 0 )
  {
    if( (*(_BYTE *)(v8 + 51) & 0x10) != 0 && (*(_WORD *)(v8 + 44) & 0x2000) != 0 )
    {
      v11 = 2;
      goto LABEL_6;
    }
    if( *((_QWORD *)DynamicRelocations + 4) < 0x100000000ui64 )
    {
      v11 = 1;
LABEL_6:
      v4->u2.WritableUserReferences ^= (v4->u2.WritableUserReferences ^ (v11 << 20)) & 0x300000;
      v8 = *((_QWORD *)DynamicRelocations + 7);
      v31 = v8;
      goto LABEL_7;
    }
    v11 = 0;
LABEL_5:
    v31 = v8;
    if( v11 == 4 )
      goto LABEL_7;
    goto LABEL_6;
  }
  ImageWowSubsystemIndex = MiGetImageWowSubsystemIndex((INT64)DynamicRelocations);
  if( ImageWowSubsystemIndex != -1 )
  {
    v11 = ImageWowSubsystemIndex + 3;
    goto LABEL_5;
  }
  v11 = 4;
LABEL_7:
  LODWORD(v12) = DynamicRelocations[2];
  if( RelocationImageType )
  {
    LOBYTE(v22) = MiBytesToMapSystemImage((_FAST_MUTEX *)(unsigned int)((_DWORD)v12 << 12));
    if( !v22 )
      return;
    RelocationImageType = RelocationImageTypea;
    v12 = v22 >> 12;
  }
  else if( dword_140C4C9F0 )
  {
    v25 = ((unsigned int)MiUserHotPatchReserveSize >> 12) + ((MiUserHotPatchReserveSize & 0xFFF) != 0);
    if( v25 )
    {
      if( v25 + (unsigned int)v12 < (unsigned int)v12 )
        return;
      LODWORD(v12) = v25 + v12;
    }
  }
  v13 = -1i64;
  if( v7 == 1 )
  {
    LOWORD(v15) = 0;
    v10 = *((_QWORD *)DynamicRelocations + 4);
    goto LABEL_27;
  }
  v14 = *((_QWORD *)DynamicRelocations + 4) - v9->SegmentLock._bf_0;
  v15 = (unsigned int)(v12 + 15) >> 4;
  if( RelocationImageType == UserImageRelocations )
  {
    if( (*(_WORD *)(v8 + 44) & 0x2000) != 0 )
    {
      *(_OWORD *)HighVa = 0i64;
      v16 = v11 != 4;
      if( dword_140CFA190 )
      {
        LOBYTE(v26) = MiImageCanUseHighOverflowArea((INT64)DynamicRelocations, v14);
        if( v26 )
          v16 = 0;
      }
      if( v16 )
      {
        MiGetImageBitMapInfo((_RTL_BITMAP **)v11, HighVa, &Bias, (UINT64)&StartBit);
        MiSelectRelocationStartHint((_RTL_BITMAP **)HighVa, v15, StartBit, 0i64);
        v13 = v17;
        if( v17 == -1i64 )
        {
          v8 = v31;
        }
        else
        {
          MiObtainRelocationBits((_RTL_BITMAP **)HighVa, v15, v17, v18);
          v8 = v31;
          v13 = v19;
          if( v19 != -1 )
            v10 = Bias - ((v19 + (unsigned __int16)v15) << 16);
        }
      }
    }
    if( v13 != -1 )
      goto LABEL_18;
    WritableUserReferences = v4->u2.WritableUserReferences;
    if( (WritableUserReferences & 0x800000) != 0 )
    {
      v10 = *((_QWORD *)DynamicRelocations + 4);
      v5 = 1;
      goto LABEL_20;
    }
    if( v11 )
    {
      if( (*(_WORD *)(v8 + 44) & 0x2000) != 0 )
      {
        LODWORD(v27) = MiSelectOverflowDllBase((INT64)DynamicRelocations, v14);
        v10 = v27;
      }
      else
      {
        v24 = (unsigned __int64)(unsigned __int8)ExGenRandom(ExGenRandomDomainUserVisible) << 16;
        v10 = v14 - v24;
        if( v14 < 0x1000000 )
          v10 = v24 + 0x10000;
      }
    }
    else
    {
      v10 = ((unsigned int)ExGenRandom(ExGenRandomDomainUserVisible) % (131073i64 - (unsigned __int16)v15) + 2146828288) << 16;
    }
LABEL_27:
    v5 = 1;
LABEL_18:
    v4->u2.NumberOfSystemCacheViews = v13;
    v4->u2._bf_0 = v15;
LABEL_19:
    WritableUserReferences = v4->u2.WritableUserReferences;
LABEL_20:
    v4->u2.WritableUserReferences = (v5 << 23) | WritableUserReferences & 0xFF7FFFFF;
    *v33 = v10;
    return;
  }
  v23 = MiSelectSystemImageAddress(RelocationImageType, (unsigned int)v12);
  v10 = (__int64)v23;
  if( v23 )
  {
    v4->u2._bf_0 = v15;
    v4->u2.NumberOfSystemCacheViews = ((unsigned __int64)v23 + 0x800000000000i64) >> 16;
    MiSetControlAreaSystemVa(v4, RelocationImageTypea);
    goto LABEL_19;
  }
}

Referenced by: