MiDriverLoadSucceeded

VOID __stdcall MiDriverLoadSucceeded(
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry,
        _SECTION *Section,
        _UNICODE_STRING *ImageFileName,
        _UNICODE_STRING *PrefixedImageName,
        _UNICODE_STRING *BaseName,
        UINT8 InitialLoad,
        UINT64 LoadFlags){
  _CONTROL_AREA *v10; 
  _SEGMENT *Segment; 
  unsigned __int8 UChar2; 
  _FILE_OBJECT *v13; 
  WCHAR *Pool; 
  _UNICODE_STRING v15; 
  NTSTATUS v16; 
  UINT64 v17; 
  _UNICODE_STRING DestinationString; 
  _IMAGE_INFO_EX ExtendedInfo; 
  __int64 v20; 

  v20 = 0i64;
  memset(&ExtendedInfo, 0, sizeof(ExtendedInfo));
  if( InitialLoad == 1 )
  {
    DataTableEntry->Flags |= 0x41004000u;
    v10 = MiSectionControlArea(Section);
    Segment = v10->Segment;
    LOBYTE(ExtendedInfo.ImageInfo.anonymous_0.Properties) = 3;
    UChar2 = Segment->SegmentFlags.UChar2;
    ExtendedInfo.ImageInfo.ImageSelector = 0;
    LODWORD(ExtendedInfo.FileObject) = 0;
    *(_QWORD *)&ExtendedInfo.ImageInfo.ImageSectionNumber = DataTableEntry->SizeOfImage;
    ExtendedInfo.ImageInfo.ImageBase = DataTableEntry->DllBase;
    ExtendedInfo.ImageInfo.anonymous_0.Properties = ExtendedInfo.ImageInfo.anonymous_0.Properties & 0xFFF80FFF | ((UChar2 & 0xF1 | ((UChar2 & 0xE) << 7) | 1) << 8);
    v13 = MiReferenceControlAreaFile(v10);
    PsCallImageNotifyRoutines(ImageFileName, 0i64, &ExtendedInfo, v13);
    MiDereferenceControlAreaFile(v10, v13);
    if( MiCacheImageSymbols(DataTableEntry->DllBase) )
    {
      DestinationString = 0i64;
      Pool = (WCHAR *)MiAllocatePool(256i64, 0x100ui64, 0x6E4C6D4Dui64);
      if( Pool )
      {
        if( PrefixedImageName->Length <= 0x16u
          || wcsnicmp(PrefixedImageName->Buffer, (const wchar_t *)L"\\SystemRoot", 0xBu) )
        {
          v16 = RtlStringCbPrintfW(Pool, 0x100ui64, (WCHAR *)L"%wZ");
        }
        else
        {
          v15 = *PrefixedImageName;
          *(_QWORD *)&DestinationString.Length = *(_QWORD *)&PrefixedImageName->Length;
          DestinationString.Buffer = (wchar_t *)(_mm_srli_si128((__m128i)v15, 8).m128i_u64[0] + 22);
          DestinationString.Length -= 22;
          RtlGetNtSystemRoot();
          v16 = RtlStringCbPrintfW(Pool, 0x100ui64, (WCHAR *)L"%ws%wZ");
        }
        if( v16 >= 0 )
        {
          RtlInitUnicodeString(&DestinationString, Pool);
          if( (unsigned int)DbgLoadImageSymbolsUnicode(&DestinationString, DataTableEntry->DllBase, v17) == 1 )
            DataTableEntry->Flags |= 0x100000u;
        }
        ExFreePoolWithTag(Pool, 0);
      }
    }
  }
  if( !*(_QWORD *)&MiSectionControlArea((_SECTION *)DataTableEntry->SectionPointer)[1].gap8[8]
    || (DataTableEntry->Flags & 0x8000000) == 0 )
  {
    MiProtectSystemImage(DataTableEntry);
  }
  if( MiGetSystemRegionType((UINT64)DataTableEntry->DllBase) == 1 )
    MiSessionUpdateImageCharges(DataTableEntry);
}

Referenced by: