MiRememberUnloadedDriver

VOID __stdcall MiRememberUnloadedDriver(UNICODE_STRING *DriverName, PVOID Address, UINT64 a3){
  __int64 v3; 
  _ETHREAD *CurrentThread; 
  char *v7; 
  __int64 v8; 
  _UNICODE_STRING *v9; 
  UINT8 *v10; 
  char *v11; 
  v3 = (unsigned int)a3;
  if( DriverName->Length )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquireResourceExclusiveLite(&PsLoadedModuleResource, 1u);
    v7 = (char *)MmUnloadedDrivers;
    if( MmUnloadedDrivers )
    {
      v8 = (unsigned int)MmLastUnloadedDriver;
      if( (unsigned int)MmLastUnloadedDriver < 0x32 )
        goto LABEL_4;
    }
    else
    {
      LODWORD(v11) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
      MmUnloadedDrivers = v11;
      v7 = v11;
      if( !v11 )
      {
LABEL_6:
        MiReleaseResourceLite((__int64)CurrentThread);
        return;
      }
    }
    v8 = 0i64;
    MmLastUnloadedDriver = 0;
LABEL_4:
    v9 = (_UNICODE_STRING *)&v7[40 * v8];
    RtlFreeAnsiString(v9);
    LODWORD(v10) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
    v9->Buffer = (wchar_t *)v10;
    if( v10 )
    {
      memmove(v10, (UINT8 *)DriverName->Buffer, DriverName->Length);
      v9->Length = DriverName->Length;
      v9->MaximumLength = DriverName->MaximumLength;
      v9[1].Buffer = (wchar_t *)((char *)Address + v3);
      *(_QWORD *)&v9[1].Length = Address;
      *(_QWORD *)&v9[2].Length = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
      ++MmLastUnloadedDriver;
    }
    else
    {
      *(_DWORD *)&v9->Length = 0;
    }
    goto LABEL_6;
  }
}

Referenced by: