MiHotPatchProcess

NTSTATUS __stdcall MiHotPatchProcess(_EX_RUNDOWN_REF *a1, INT64 a2, INT64 a3){
  _EX_RUNDOWN_REF *v3; 
  int v5; 
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  _MMVAD_SHORT *Count; 
  _MMVAD_SHORT *i; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v11; 
  __int64 v12; 
  __int64 v13; 
  INT64 v14; 
  INT64 v15; 
  NTSTATUS v16; 
  PVOID v17; 
  _MMVAD_SHORT **ExtraCreateInfo; 
  _MMVAD_SHORT *v19; 
  _MMVAD_SHORT *NextVad; 

  v3 = a1 + 139;
  v5 = a3;
  v6 = a2;
  if( !ExAcquireRundownProtection(a1 + 139) )
    return -1073741558;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  LOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
LABEL_4:
  Count = (_MMVAD_SHORT *)a1[251].Count;
  i = 0i64;
  while( Count )
  {
    i = Count;
    Count = Count->NextVad;
  }
  while( i )
  {
    if( (i->u.LongFlags & 0x70) == 32 )
    {
      MiLockVadShared((INT64)CurrentThread, (INT64)i);
      if( !MiVadDeleted(i)
        && (v11.LongFlags = (unsigned int)i->u, (v11.LongFlags & 0x100000) == 0)
        && (v11.LongFlags & 0x70) == 32
        && (v11.LongFlags & 0x400000) != 0
        && (v12 = *(_QWORD *)i[1].ExtraCreateInfo, v13 = *(_QWORD *)(*(_QWORD *)v12 + 56i64),
                                                   *(_DWORD *)(v13 + 60) == v6)
        && *(_DWORD *)(v13 + 72) == v5 )
      {
        v14 = _InterlockedCompareExchange64((volatile signed __int64 *)(*(_QWORD *)v12 + 24i64), -1i64, -1i64);
        MiReferenceVad(i);
        MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)i);
        UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
        MiHotPatchImage(v15, v14, (WCHAR)i, v6);
        LOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
        MiLockVadShared((INT64)CurrentThread, (INT64)i);
        v16 = MiVadDeleted(i);
        MiUnlockAndDereferenceVadShared(v17);
        if( v16 )
          goto LABEL_4;
      }
      else
      {
        MiUnlockVadShared(&CurrentThread->Tcb, (_EX_PUSH_LOCK *)i);
      }
    }
    ExtraCreateInfo = (_MMVAD_SHORT **)i->ExtraCreateInfo;
    v19 = i;
    if( ExtraCreateInfo )
    {
      NextVad = *ExtraCreateInfo;
      for( i = (_MMVAD_SHORT *)i->ExtraCreateInfo; NextVad; NextVad = NextVad->NextVad )
        i = NextVad;
    }
    else
    {
      while( 1 )
      {
        i = (_MMVAD_SHORT *)(i->VadNode.ParentValue & 0xFFFFFFFFFFFFFFFCui64);
        if( !i || i->NextVad == v19 )
          break;
        v19 = i;
      }
    }
  }
  UNLOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
  ExReleaseRundownProtection(v3);
  return 0;
}

Referenced by: