MiOpenHotPatchFile

INT64 __fastcall MiOpenHotPatchFile(
        INT64 a1,
        INT64 a2,
        UINT8 a3,
        PVOID *a4,
        INT64 *a5,
        _OWORD *a6,
        _DWORD *a7,
        UINT64 *a8){
  int v8; 
  INT64 v10; 
  int v11; 
  INT64 v12; 
  int v13; 
  int v14; 
  int v15; 
  int SessionId; 
  _CONTROL_AREA *v17; 
  UINT64 v18; 
  wchar_t *Buffer; 
  wchar_t *v20; 
  UINT64 *HotPatchInformation; 
  CHAR *HotPatchBase; 
  LARGE_INTEGER *ShareAccess; 
  UINT64 OpenOptions; 
  UINT64 v26; 
  INT64 v27; 
  INT64 v28; 
  UINT64 v29; 
  INT64 v30; 
  PADAPTER_OBJECT DmaAdapter; 
  UNICODE_STRING FileHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  PVOID *v35; 
  INT64 *v36; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  PVOID BaseAddress[2]; 
  __int128 v39; 
  __int128 v40; 
  __int128 v41; 
  __int128 v42; 
  v35 = a4;
  v8 = a2;
  v36 = a5;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  IoStatusBlock = 0i64;
  memset((INT64)BaseAddress, 0i64);
  FileHandle.Buffer = 0i64;
  DmaAdapter = 0i64;
  *(_QWORD *)&FileHandle.Length = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)a1;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v11 = ZwOpenFile(&FileHandle, (PWCHAR)0x20);
  if( v11 >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( v8 )
    {
      v13 = 2;
      v14 = 285212672;
      v15 = 0;
      SessionId = -1;
    }
    else
    {
      v13 = 16;
      v14 = 0x1000000;
      v15 = 1;
      SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
    }
    LODWORD(v30) = v15;
    LODWORD(v29) = SessionId;
    LODWORD(v26) = 0;
    LODWORD(OpenOptions) = v14;
    LODWORD(ShareAccess) = v13;
    v11 = MiCreateSystemSection(
            (VOID **)&DmaAdapter,
            v10,
            &ObjectAttributes,
            v12,
            ShareAccess,
            OpenOptions,
            v26,
            *(VOID **)&FileHandle.Length,
            v27,
            v28,
            v29,
            v30,
            a3);
    if( v11 >= 0 )
    {
      v17 = MiSectionControlArea((_SECTION *)DmaAdapter);
      v11 = MiMapImageInSystemSpace((__int64)v17, 1, (__int64)BaseAddress);
      if( v11 >= 0 )
      {
        v18 = (unsigned __int64)(unsigned int)v39 << 12;
        v11 = RtlImageNtHeaderEx(0i64, BaseAddress[0], v18, (IMAGE_NT_HEADERS **)&FileHandle.Buffer);
        if( v11 >= 0 )
        {
          Buffer = FileHandle.Buffer;
          v20 = FileHandle.Buffer + 4;
          if( FileHandle.Buffer + 4 < FileHandle.Buffer || v20 > (wchar_t *)((char *)BaseAddress[0] + v18) )
          {
            v11 = -1073741701;
          }
          else
          {
            if( FileHandle.Buffer[2] != 0x8664 )
            {
              v11 = -1073741701;
              goto LABEL_24;
            }
            HotPatchInformation = (UINT64 *)RtlFindHotPatchInformation(BaseAddress[0]);
            if( !HotPatchInformation )
            {
              v11 = -1073741701;
              goto LABEL_24;
            }
            if( a7 )
            {
              HotPatchBase = RtlFindHotPatchBase(HotPatchInformation);
              if( !HotPatchBase )
              {
                v11 = -1073741701;
                goto LABEL_24;
              }
              *a7 = *((_DWORD *)HotPatchBase + 3);
              a7[1] = *((_DWORD *)HotPatchBase + 2);
            }
            if( a8 )
            {
              *(_DWORD *)a8 = *((_DWORD *)Buffer + 22);
              *((_DWORD *)a8 + 1) = *(_DWORD *)v20;
            }
            *v35 = *(PVOID *)&FileHandle.Length;
            *(_QWORD *)&FileHandle.Length = 0i64;
            *v36 = (INT64)DmaAdapter;
            DmaAdapter = 0i64;
            if( a6 )
            {
              *a6 = *(_OWORD *)BaseAddress;
              a6[1] = v39;
              a6[2] = v40;
              a6[3] = v41;
              a6[4] = v42;
              BaseAddress[0] = 0i64;
            }
            v11 = 0;
          }
        }
      }
    }
  }
LABEL_24:
  if( BaseAddress[0] )
    MiUnmapImageInSystemSpace((INT64)BaseAddress);
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  if( *(_QWORD *)&FileHandle.Length )
    ObCloseHandle(*(PVOID *)&FileHandle.Length, 0);
  return(unsigned int)v11;
}

Referenced by: