MiLogPinDriverAddress
void __fastcall MiLogPinDriverAddress(_QWORD *a1){
_ETHREAD *CurrentThread;
VOID *v3;
_LIST_ENTRY *v4;
int Blink;
wchar_t **p_Blink;
int Blink_high;
__int64 v8;
__int64 v9;
unsigned int v10;
unsigned int v11;
unsigned int v12;
unsigned int v13;
unsigned int v14;
unsigned int v15;
int v16;
unsigned int v17;
unsigned int v18;
int v19;
int v20;
__int64 v21;
_UNICODE_STRING DestinationString[2];
_EVENT_DATA_DESCRIPTOR v23;
__int64 *v24;
__int64 v25;
int *v26;
__int64 v27;
int *v28;
__int64 v29;
int *v30;
__int64 v31;
int *v32;
__int64 v33;
int *v34;
__int64 v35;
int *v36;
__int64 v37;
int *v38;
__int64 v39;
int *v40;
__int64 v41;
int *v42;
__int64 v43;
wchar_t *v44;
int v45[2];
int *v46;
__int64 v47;
int *v48;
__int64 v49;
_UNICODE_STRING *v50;
__int64 v51;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = (VOID *)(*a1 & 0xFFFFFFFFFFFFF000ui64);
*(_OWORD *)&DestinationString[0].Buffer = 0i64;
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
v4 = MiLookupDataTableEntry(v3, 0i64);
if( v4 )
{
Blink = (int)v4[7].Blink;
p_Blink = (wchar_t **)&v4[5].Blink;
Blink_high = HIDWORD(v4[9].Blink);
}
else
{
Blink = 0;
Blink_high = 0;
p_Blink = &DestinationString[0].Buffer;
RtlInitUnicodeString((PUNICODE_STRING)&DestinationString[0].Buffer, L"Image not found");
}
if( **(&stru_140C4DB30 + 542) > 5u && tlgKeywordOn(*(&stru_140C4DB30 + 542), 0x400000000000i64) )
{
v10 = *(_DWORD *)a1;
v24 = &v21;
v21 = 1i64;
v11 = (v10 >> 1) & 1;
v26 = (int *)&v11;
v25 = 8i64;
v12 = (v10 >> 2) & 1;
v28 = (int *)&v12;
v27 = 4i64;
v13 = (v10 >> 3) & 1;
v30 = (int *)&v13;
v29 = 4i64;
v14 = (v10 >> 4) & 1;
v32 = (int *)&v14;
v31 = 4i64;
v15 = (v10 >> 5) & 1;
v34 = (int *)&v15;
v33 = 4i64;
v16 = (unsigned __int8)v10 >> 6;
v36 = &v16;
v17 = (v10 >> 10) & 3;
v35 = 4i64;
v38 = (int *)&v17;
v40 = (int *)&v18;
v42 = v45;
v44 = p_Blink[1];
v45[0] = *(unsigned __int16 *)p_Blink;
v46 = &v19;
v48 = &v20;
*(_QWORD *)&DestinationString[0].Length = 2164260864i64;
v50 = DestinationString;
v37 = 4i64;
v39 = 4i64;
v18 = (v10 >> 8) & 3;
v41 = 4i64;
v43 = 2i64;
v45[1] = 0;
v19 = Blink;
v47 = 4i64;
v20 = Blink_high;
v49 = 4i64;
v51 = 8i64;
tlgWriteAgg(v9, (unsigned __int8 *)&byte_1400259F0, v8, 0x10u, &v23);
}
ExReleaseResourceLite(&PsLoadedModuleResource);
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
}Referenced by:
MiLogPinDriverAddressesWorker