MiObtainSectionForDriver

NTSTATUS __stdcall MiObtainSectionForDriver(
        _UNICODE_STRING *PrefixedImageName,
        _UNICODE_STRING *ImageFileName,
        UINT64 LoadFlags,
        _KLDR_DATA_TABLE_ENTRY **FoundDataTableEntry){
  _QWORD *v4; 
  _ETHREAD *CurrentThread; 
  unsigned int v7; 
  VOID *v8; 
  INT64 v11; 
  INT8 v12; 
  INT64 v13; 
  NTSTATUS v14; 
  union {_MI_SECTION_IMAGE_INFORMATION *ImageInformation;void *FirstMappedVa;} v15; 
  signed __int16 v16; 
  _QWORD *TempLoaderEntry; 
  NTSTATUS SystemRegionType; 
  VOID *a4; 

  v4 = a4;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  a4 = 0i64;
  v7 = (unsigned int)FoundDataTableEntry;
  v8 = 0i64;
  *v4 = 0i64;
  do
  {
    v11 = PsLoadedModuleList;
    if( (INT64 *)PsLoadedModuleList != &PsLoadedModuleList )
    {
      while( !(unsigned __int8)RtlEqualUnicodeString(PrefixedImageName, (PCUNICODE_STRING)(v11 + 72), 1u) )
      {
        v11 = *(_QWORD *)v11;
        if( (INT64 *)v11 == &PsLoadedModuleList )
          goto LABEL_5;
      }
      if( v8 )
        ObDereferenceObjectDeferDelete((UINT64)v8);
      SystemRegionType = MiGetSystemRegionType(*(_QWORD *)(v11 + 48));
      if( (v7 & 1) != 0 )
      {
        if( SystemRegionType == 1 )
        {
LABEL_21:
          *v4 = v11;
          return 272;
        }
      }
      else if( SystemRegionType != 1 )
      {
        goto LABEL_21;
      }
      return -1073741800;
    }
LABEL_5:
    if( v8 )
    {
      TempLoaderEntry = MiAllocateTempLoaderEntry((__int64)v8);
      if( TempLoaderEntry )
      {
        *v4 = TempLoaderEntry;
        return 0;
      }
      v14 = -1073741670;
      goto LABEL_26;
    }
    if( !LoadFlags )
      MmReleaseLoadLock(CurrentThread);
    v14 = (unsigned int)MiCreateSectionForDriver(ImageFileName, (VOID *)LoadFlags, v7, &a4);
    if( !LoadFlags )
      MmAcquireLoadLock(v13, v12);
    if( v14 < 0 )
      return v14;
    v8 = a4;
    v15.ImageInformation = (_MI_SECTION_IMAGE_INFORMATION *)MiSectionControlArea((_SECTION *)a4)->Segment->u2;
  }
  while( (__int16)v15.ImageInformation->ExportedImageInformation.DllCharacteristics >= v16
       || v15.ImageInformation->ExportedImageInformation.SubSystemType != 1
       || (v7 & 1) != 0 );
  v14 = -1073741800;
LABEL_26:
  ObDereferenceObjectDeferDelete((UINT64)v8);
  return v14;
}

Referenced by: