MiResolveImageImports

NTSTATUS __fastcall MiResolveImageImports(
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry,
        _UNICODE_STRING *a2,
        _UNICODE_STRING *a3,
        _UNICODE_STRING *a4,
        INT64 a5){
  char *DllBase; 
  unsigned int v9; 
  VOID *v10; 
  unsigned int *v11; 
  VOID *v12; 
  unsigned int v13; 
  int v14; 
  _UNICODE_STRING *v15; 
  int v16; 
  __int64 v18; 
  char *v19; 
  char *v20; 
  int v21; 
  int i; 
  int v23; 
  unsigned int *j; 
  __int64 v25; 
  char *v26; 
  int v27; 
  int v28; 
  __int64 Size[9]; 
  UINT64 NumberOfBytes; 
  _UNICODE_STRING *NamePrefix; 

  NamePrefix = a2;
  DllBase = (char *)DataTableEntry->DllBase;
  LODWORD(NumberOfBytes) = 0;
  LODWORD(Size[0]) = 0;
  v9 = 0;
  v10 = RtlImageDirectoryEntryToData(DllBase, 1u, 0xCu, &NumberOfBytes);
  v11 = 0i64;
  v12 = v10;
  if( !v10 || (v13 = NumberOfBytes) == 0 )
  {
    v12 = 0i64;
    v13 = 0;
    v11 = (unsigned int *)RtlImageDirectoryEntryToData(DllBase, 1u, 1u, (UINT64 *)Size);
    if( !v11 )
      return 0;
    do
    {
      v18 = *v11;
      if( !(_DWORD)v18 )
        break;
      v19 = &DllBase[v18];
      v20 = &DllBase[v11[4]];
      v21 = 0;
      for( i = 0; *(_QWORD *)v19; i = v21 )
      {
        ++v21;
        v19 += 8;
      }
      v13 = 8 * i;
      LODWORD(NumberOfBytes) = v13;
      MiSetImageProtection(DataTableEntry, v20, v13, 4ui64);
      if( !v23 )
      {
        MiLogStrongCodeDriverLoadFailure((INT8 *)"UnwritableImportDirectory", DataTableEntry);
        dword_140C4C958 = 193;
        return -1073741701;
      }
      ++v9;
      v11 += 5;
    }
    while( v11 );
    if( !v9 )
      return 0;
    goto LABEL_5;
  }
  MiSetImageProtection(DataTableEntry, v10, (unsigned int)NumberOfBytes, 4ui64);
  if( v14 )
  {
    v9 = 1;
LABEL_5:
    v15 = NamePrefix;
    DataTableEntry->Flags |= 0x1000u;
    v16 = MiResolveImageReferences(DataTableEntry, a4, a3, v15, (PVOID *)Size[0]);
    if( *(_QWORD *)&MiSectionControlArea((_SECTION *)DataTableEntry->SectionPointer)[1].gap8[8] )
    {
      if( v12 )
      {
        MiSetImageProtection(DataTableEntry, v12, v13, 0x100ui64);
      }
      else
      {
        for( j = &v11[-5 * v9]; j; j += 5 )
        {
          v25 = *j;
          if( !(_DWORD)v25 )
            break;
          v26 = &DllBase[v25];
          v27 = 0;
          v28 = 0;
          while( *(_QWORD *)v26 )
          {
            ++v27;
            v26 += 8;
            v28 = v27;
          }
          MiSetImageProtection(DataTableEntry, &DllBase[j[4]], (unsigned int)(8 * v28), 0x100ui64);
        }
      }
    }
    DataTableEntry->Flags &= ~0x1000u;
    if( v16 < 0 )
      *(_BYTE *)a5 = 1;
    return v16;
  }
  MiLogStrongCodeDriverLoadFailure((INT8 *)"UnwritableIAT", DataTableEntry);
  dword_140C4C958 = 192;
  return -1073741701;
}

Referenced by: