MiMarkKernelImageCfgBits

NTSTATUS __fastcall MiMarkKernelImageCfgBits(_KLDR_DATA_TABLE_ENTRY *DataTableEntry, INT64 a2){
  int KernelCfgBitmapPageTables; 
  _ETHREAD *CurrentThread; 
  UINT64 SizeOfImage; 
  void *DllBase; 
  unsigned int v8; 
  _QWORD *v9; 
  _QWORD *v10; 
  UINT64 v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  UINT64 Size; 
  _MMPTE *EndPte; 
  __int64 v16; 
  UINT64 v17[2]; 
  int v18; 
  __int64 v19; 
  int v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  __int64 v24; 
  INT64 v25[14]; 

  v16 = 0i64;
  v19 = 0i64;
  v20 = 0;
  v22 = 0i64;
  v24 = 0i64;
  EndPte = 0i64;
  LODWORD(Size) = 0;
  if( a2 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(&stru_140C4C980, 0i64);
    KernelCfgBitmapPageTables = MiAllocateKernelCfgBitmapPageTables(
                                  (INT64)DataTableEntry->DllBase,
                                  DataTableEntry->SizeOfImage);
    MiReleaseKernelCfgLock();
    if( KernelCfgBitmapPageTables >= 0 )
    {
      SizeOfImage = DataTableEntry->SizeOfImage;
      DllBase = DataTableEntry->DllBase;
      v8 = DataTableEntry->SizeOfImage;
      v17[0] = (UINT64)DataTableEntry;
      v17[1] = 0i64;
      v21 = 0i64;
      v23 = 0i64;
      v18 = (v8 >> 12) + ((SizeOfImage & 0xFFF) != 0);
      KernelCfgBitmapPageTables = VslCompleteSecureDriverLoad(
                                    (INT64)DataTableEntry->SectionPointer,
                                    (INT64)DllBase,
                                    SizeOfImage);
      MiUnlockDriverPages(v17);
      if( KernelCfgBitmapPageTables >= 0 )
      {
        v9 = RtlImageDirectoryEntryToData(DataTableEntry->DllBase, 1u, 0xAu, &Size);
        v10 = v9;
        if( v9 && (unsigned int)Size >= 0xB0 && v9[21] )
        {
          v11 = 0i64;
          while( 1 )
          {
            LODWORD(v11) = MiSnapDriverRange(DataTableEntry, v11, 2ui64, 0i64, &EndPte);
            if( EndPte )
            {
              v12 = v10[20];
              v13 = (_QWORD)MmGetPteBase() << 25;
              if( v12 >= (((_QWORD)EndPte << 25) - v13) >> 16 && v12 <= (((v16 << 25) - v13) | 0xFFF0000) >> 16 )
                break;
            }
            if( !(_DWORD)v11 )
              return KernelCfgBitmapPageTables;
          }
          DataTableEntry->Flags |= 0x800u;
        }
        else
        {
          DataTableEntry->Flags |= 0x100u;
        }
      }
    }
  }
  else if( (MiFlags & 0x8000) != 0 )
  {
    memset(v25, 0i64, 0x68u);
    v25[1] = (INT64)DataTableEntry->DllBase;
    KernelCfgBitmapPageTables = VslpEnterIumSecureMode(2u, 217, 0i64, (INT64)v25);
    if( (MiFlags & 0x80000) != 0 )
      MiFlushKernelCfgBitmap((INT64)DataTableEntry->DllBase, DataTableEntry->SizeOfImage);
  }
  else
  {
    return 0;
  }
  return KernelCfgBitmapPageTables;
}

Referenced by: