MiReturnImageBase
VOID __fastcall MiReturnImageBase(INT64 a1){
UINT64 v1;
_ETHREAD *CurrentThread;
__int128 HighVa;
UINT64 Bias;
Bias = 0i64;
v1 = *(_QWORD *)a1;
HighVa = 0i64;
if( v1 != -1i64 )
{
if( *(_BYTE *)(a1 + 12) == 1 )
{
if( *(_BYTE *)(a1 + 13) == 1 )
MiReturnSystemImageAddress((PVOID)((v1 - 0x80000000) << 16), (unsigned int)(*(_DWORD *)(a1 + 8) << 16));
}
else
{
MiGetImageBitMapInfo((RTL_BITMAP **)*(unsigned int *)(a1 + 16), (UINT64 *)&HighVa, &Bias);
MiZeroCfgSystemWideBitmap(a1, Bias - ((v1 + *(unsigned int *)(a1 + 8)) << 16));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C888, 0i64);
if( *((_QWORD *)&HighVa + 1) )
RtlClearBitsEx(*((INT64 *)&HighVa + 1), v1, *(unsigned int *)(a1 + 8));
RtlClearBitsEx(HighVa, v1, *(unsigned int *)(a1 + 8));
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C888, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C888);
KeAbPostRelease(&qword_140C4C888);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}
}
}Referenced by:
MiCheckControlArea
MiFreeRelocations
MiRelocateImageAgain