MiResolveImageImports

INT64 __fastcall MiResolveImageImports(
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry,
        INT64 a2,
        _UNICODE_STRING *a3,
        _UNICODE_STRING *a4,
        _BYTE *a5){
  char *v5; 
  unsigned int v9; 
  VOID *v10; 
  unsigned int *v11; 
  VOID *v12; 
  unsigned int v13; 
  int v14; 
  _UNICODE_STRING *v15; 
  int v16; 
  unsigned int *v18; 
  __int64 v19; 
  char *v20; 
  char *v21; 
  int v22; 
  int i; 
  int v24; 
  unsigned int *j; 
  __int64 v26; 
  char *v27; 
  int v28; 
  int v29; 
  int Size[18]; 
  UINT64 NumberOfBytes; 
  _UNICODE_STRING *NamePrefix; 
  NamePrefix = (_UNICODE_STRING *)a2;
  v5 = (char *)*((_QWORD *)DataTableEntry + 6);
  LODWORD(NumberOfBytes) = 0;
  Size[0] = 0;
  v9 = 0;
  LODWORD(v10) = RtlImageDirectoryEntryToData(v5, 1u, 0xCu, &NumberOfBytes);
  v11 = 0i64;
  v12 = v10;
  if( !v10 || (v13 = NumberOfBytes) == 0 )
  {
    v12 = 0i64;
    v13 = 0;
    LODWORD(v18) = RtlImageDirectoryEntryToData(v5, 1u, 1u, (UINT64 *)Size);
    v11 = v18;
    if( !v18 )
      return 0i64;
    do
    {
      v19 = *v11;
      if( !(_DWORD)v19 )
        break;
      v20 = &v5[v19];
      v21 = &v5[v11[4]];
      v22 = 0;
      for( i = 0; *(_QWORD *)v20; i = v22 )
      {
        ++v22;
        v20 += 8;
      }
      v13 = 8 * i;
      LODWORD(NumberOfBytes) = v13;
      MiSetImageProtection(DataTableEntry, v21, v13, 4ui64);
      if( !v24 )
      {
        MiLogStrongCodeDriverLoadFailure("UnwritableImportDirectory", (__int64)DataTableEntry);
        dword_140C4C958 = 193;
        return 3221225595i64;
      }
      ++v9;
      v11 += 5;
    }
    while( v11 );
    if( !v9 )
      return 0i64;
    goto LABEL_5;
  }
  MiSetImageProtection(DataTableEntry, v10, (unsigned int)NumberOfBytes, 4ui64);
  if( v14 )
  {
    v9 = 1;
LABEL_5:
    v15 = NamePrefix;
    *((_DWORD *)DataTableEntry + 26) |= 0x1000u;
    v16 = MiResolveImageReferences(DataTableEntry, a4, a3, v15, *(_LOAD_IMPORTS ***)Size);
    if( *((_QWORD *)MiSectionControlArea(*((_SECTION **)DataTableEntry + 14)) + 18) )
    {
      if( v12 )
      {
        MiSetImageProtection(DataTableEntry, v12, v13, 0x100ui64);
      }
      else
      {
        for( j = &v11[-5 * v9]; j; j += 5 )
        {
          v26 = *j;
          if( !(_DWORD)v26 )
            break;
          v27 = &v5[v26];
          v28 = 0;
          v29 = 0;
          while( *(_QWORD *)v27 )
          {
            ++v28;
            v27 += 8;
            v29 = v28;
          }
          MiSetImageProtection(DataTableEntry, &v5[j[4]], (unsigned int)(8 * v29), 0x100ui64);
        }
      }
    }
    *((_DWORD *)DataTableEntry + 26) &= ~0x1000u;
    if( v16 < 0 )
      *a5 = 1;
    return(unsigned int)v16;
  }
  MiLogStrongCodeDriverLoadFailure("UnwritableIAT", (__int64)DataTableEntry);
  dword_140C4C958 = 192;
  return 3221225595i64;
}

Referenced by: