MiImageUnused
INT64 __fastcall MiImageUnused(INT64 a1, INT64 a2, INT64 a3){
INT64 result;
KIRQL v6;
unsigned int v7;
*(_QWORD *)(a3 + 8) = 0i64;
*(_QWORD *)(a3 + 16) = 0i64;
result = *(_QWORD *)(a1 + 96);
*(_QWORD *)a3 = -1i64;
if( *(_QWORD *)(result + 32) )
{
if( (_DWORD)a2 == 1 )
v6 = 17;
else
v6 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)(a1 + 72));
result = *(unsigned int *)(a1 + 88);
if( (_DWORD)result != -1 )
{
*(_QWORD *)a3 = (unsigned int)result;
v7 = *(_DWORD *)(a1 + 92);
*(_DWORD *)(a3 + 8) = (unsigned __int16)v7;
*(_DWORD *)(a3 + 16) = (v7 >> 20) & 3;
result = *(unsigned int *)(a1 + 56);
if( (result & 0x10000000) != 0 )
{
LODWORD(result) = result & 0xEFFFFFFF;
*(_DWORD *)(a1 + 56) = result;
*(_BYTE *)(a3 + 13) = BYTE2(v7) & 1;
*(_BYTE *)(a3 + 12) = 1;
}
*(_DWORD *)(a1 + 88) = -1;
}
*(_DWORD *)(a1 + 92) &= ~0x400000u;
if( v6 != 17 )
{
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a1 + 72));
result = v6;
__writecr8(v6);
}
}
return result;
}Referenced by:
MiCheckControlArea
MiRelocateImageAgain