MiMarkKernelCfgAddressTakenImports

INT64 __fastcall MiMarkKernelCfgAddressTakenImports(INT64 a1){
  __int64 v2; 
  __int64 v3; 
  unsigned int v4; 
  unsigned int v5; 
  unsigned int *v6; 
  unsigned int v7; 
  __int64 v8; 
  INT64 result; 
  UINT64 v10; 
  LODWORD(v2) = RtlImageDirectoryEntryToData(*(PVOID *)(a1 + 48), 1u, 0xAu, &v10);
  v3 = *(_QWORD *)(a1 + 48);
  v4 = 0;
  v5 = *(_DWORD *)(v2 + 168);
  v6 = *(unsigned int **)(v2 + 160);
  v7 = (*(_DWORD *)(v2 + 144) >> 28) + 4;
  if( v5 )
  {
    while( 1 )
    {
      v8 = *v6;
      if( (unsigned int)v8 > *(_DWORD *)(a1 + 64) - 8 || (v8 & 7) != 0 )
        return 3221225595i64;
      result = MiMarkKernelCfgTarget(*(_QWORD *)(v8 + v3));
      if( (int)result < 0 )
        return result;
      ++v4;
      v6 = (unsigned int *)((char *)v6 + v7);
      if( v4 >= v5 )
        goto LABEL_6;
    }
  }
  else
  {
LABEL_6:
    *(_DWORD *)(a1 + 104) |= 0x100u;
    return 0i64;
  }
}

Referenced by:

MiProcessKernelCfgAddressTakenImports