MmChangeImageProtection

VOID __stdcall MmChangeImageProtection(
        _MDL *CodeMdl,
        PVOID SignatureAddress,
        UINT64 SignatureSize,
        UINT64 ExecuteFlags){
  char *v5; 
  unsigned int ByteCount; 
  unsigned int v8; 
  _ETHREAD *Lock; 
  INT64 v10; 
  __int64 v11; 
  __int64 v12; 
  char *v13; 
  unsigned __int64 v14; 
  char *v15; 
  int v16; 
  int v17; 
  UINT8 v18; 
  WCHAR *v19; 
  unsigned int v20; 
  UNICODE_STRING *PfnDb; 
  _MDL *v22; 
  _MDL *v23; 
  int v24; 
  ULONG_PTR v25; 
  _SECTION *v26; 
  __int64 v27; 
  unsigned __int64 v28; 
  int v29; 
  UINT64 v30; 
  __int64 v31; 
  _MMPFN *v32; 
  int v35; 
  v35 = ExecuteFlags;
  v5 = (char *)SignatureAddress;
  if( (unsigned int)(ExecuteFlags - 1) <= 1 && (CodeMdl->MdlFlags & 7) == 2 && !CodeMdl->ByteOffset )
  {
    ByteCount = CodeMdl->ByteCount;
    if( (ByteCount & 0xFFF) == 0 )
    {
      v8 = ByteCount >> 12;
      Lock = MmAcquireLoadLock();
      --*((_WORD *)Lock + 242);
      --*((_WORD *)Lock + 242);
      ExAcquireResourceExclusiveLite(&PsLoadedModuleResource, 1u);
      v11 = MiLookupDataTableEntry((unsigned __int64)CodeMdl->StartVa, 0i64, v10);
      v12 = v11;
      if( v11 )
      {
        v13 = *(char **)(v11 + 48);
        v14 = (unsigned __int64)&v5[SignatureSize];
        v15 = &v13[*(unsigned int *)(v11 + 64)];
        if( (char *)CodeMdl->StartVa + CodeMdl->ByteCount > v15
          || v5 < v13
          || v14 > (unsigned __int64)v15
          || v14 - 1 < (unsigned __int64)v5 )
        {
          v17 = -1073741800;
        }
        else
        {
          v16 = *(_DWORD *)(v12 + 104);
          if( (v16 & 0x80000) != 0 )
          {
            v17 = -1073741757;
          }
          else
          {
            v17 = 0;
            *(_DWORD *)(v12 + 104) = v16 | 0x80000;
            if( (unsigned int)MiGetSystemRegionType((UINT64)v13) == 1 )
              MiSessionReferenceImage(v13);
            else
              ++*(_WORD *)(v12 + 108);
          }
        }
      }
      else
      {
        v17 = -1073741275;
      }
      ExReleaseResourceLite(&PsLoadedModuleResource);
      KeLeaveCriticalRegionThread((__int64)Lock);
      MmReleaseLoadLock(Lock);
      if( v17 >= 0 )
      {
        if( !(unsigned int)MI_IS_PHYSICAL_ADDRESS(*(PVOID *)(v12 + 48)) )
        {
          v20 = 0;
          PfnDb = (UNICODE_STRING *)MmGetPfnDb();
          v22 = CodeMdl + 1;
          if( v8 )
          {
            v23 = CodeMdl + 1;
            while( 1 )
            {
              LOBYTE(v24) = MI_PFN_IS_PROTO(&PfnDb[3 * (__int64)v23->Next], PfnDb, v18, v19);
              if( v24 || (MiGetPagePrivilege(v25, 0, 0i64) & 0x40) != 0 )
                break;
              ++v20;
              PfnDb = (UNICODE_STRING *)MmGetPfnDb();
              v23 = (_MDL *)((char *)v23 + 8);
              if( v20 >= v8 )
              {
                v5 = (char *)SignatureAddress;
                goto LABEL_25;
              }
            }
          }
          else
          {
LABEL_25:
            MiSetImageProtection((_KLDR_DATA_TABLE_ENTRY *)v12, CodeMdl->StartVa, CodeMdl->ByteCount, 1ui64);
            if( v35 == 1 )
            {
              v26 = *(_SECTION **)(v12 + 112);
              if( v26
                && (v27 = *(_QWORD *)(*((_QWORD *)MiSectionControlArea(v26) + 12) + 40i64),
                    (v27 & 0xFFFFFFFFFFFFFFF8ui64) > 8) )
              {
                v28 = v27 & 0xFFFFFFFFFFFFFFF8ui64;
              }
              else
              {
                v28 = 0i64;
              }
              if( qword_140C1D950 )
              {
                v29 = qword_140C1D950(v28, CodeMdl, v5, SignatureSize, &v5[-*(_QWORD *)(v12 + 48)]);
                if( v29 >= 0 )
                {
                  v30 = 3i64;
                  if( (MiFlags & 0x10000) != 0 && v29 == 300 )
                    v30 = 19i64;
                  MiSetImageProtection((_KLDR_DATA_TABLE_ENTRY *)v12, CodeMdl->StartVa, CodeMdl->ByteCount, v30);
                }
              }
            }
            else if( (MiFlags & 0x10000) != 0 && v8 )
            {
              v31 = v8;
              v32 = MmGetPfnDb();
              do
              {
                MiClearPfnImageVerified((UINT64)v32 + 48 * (__int64)v22->Next, 24);
                v22 = (_MDL *)((char *)v22 + 8);
                --v31;
              }
              while( v31 );
            }
          }
        }
        MmAcquireLoadLock();
        --*((_WORD *)Lock + 242);
        ExAcquireResourceExclusiveLite(&PsLoadedModuleResource, 1u);
        *(_DWORD *)(v12 + 104) &= ~0x80000u;
        ExReleaseResourceLite(&PsLoadedModuleResource);
        KeLeaveCriticalRegionThread((__int64)Lock);
        MiUnloadSystemImage((PVOID)v12, 0xFFFFFFFFui64);
        MmReleaseLoadLock(Lock);
      }
      KeLeaveCriticalRegionThread((__int64)Lock);
    }
  }
}

Referenced by: