MiParseImageSectionHeaders
INT64 __fastcall MiParseImageSectionHeaders(INT64 a1, INT64 *a2, INT64 a3, INT64 a4, INT64 a5, UINT64 a6){
INT64 v6;
INT64 *v7;
int v8;
int v9;
INT64 *v10;
unsigned __int64 *v11;
INT64 v12;
unsigned int v13;
__int64 v14;
unsigned int v15;
unsigned int v16;
unsigned int *v17;
unsigned int v18;
unsigned int v19;
int v20;
INT64 v21;
unsigned int v22;
int v23;
unsigned int v24;
unsigned int v25;
int v26;
int v27;
unsigned int v28;
__int64 v29;
__int16 v30;
INT64 SubsectionPte;
CHAR v32;
char v33;
INT64 DemandZeroPte;
unsigned int v35;
char v36;
char v37;
unsigned int v38;
unsigned int v39;
BOOL v40;
unsigned __int64 v41;
bool v42;
unsigned __int64 v43;
unsigned int v44;
unsigned int *v46;
unsigned int v47;
unsigned int v48;
unsigned int v49;
__int16 v50;
unsigned int v51;
unsigned int v52;
unsigned int v53;
unsigned int v54;
unsigned int v55;
INT64 v56;
INT64 v57;
unsigned int *v58;
__int64 v59;
int v60;
int v62;
v62 = a4;
v60 = a1;
v6 = *a2;
v7 = a2 + 16;
v8 = a1;
v9 = a4;
v10 = a2;
v56 = v6;
v11 = (unsigned __int64 *)(a2[17] + 8i64 * *((unsigned int *)a2 + 43));
*(_BYTE *)(v6 + 14) = *(_BYTE *)(*a2 + 14) & 0xC1 | 0xE;
if( (a1 & 0x200000) != 0 )
{
if( (_DWORD)a4 )
{
v46 = (unsigned int *)(a3 + 16);
while( 1 )
{
v47 = *v46;
v48 = *v46;
v49 = v46[1];
if( *(v46 - 2) )
v48 = *(v46 - 2);
if( v47 + v49 < v49 )
break;
if( v49 != *(v46 - 1) || v48 > v47 )
{
dword_140C4C958 = 17;
return 3221225595i64;
}
v46 += 10;
if( !--v9 )
goto LABEL_61;
}
dword_140C4C958 = 16;
return 3221225595i64;
}
else
{
LABEL_61:
v10[15] = *(unsigned int *)(v6 + 8);
return 0i64;
}
}
else
{
v12 = a5;
v13 = *(_DWORD *)(a5 + 12);
v14 = *(_QWORD *)(v6 + 32) + (unsigned int)(*((_DWORD *)a2 + 43) << 12);
v59 = *(_QWORD *)(v6 + 56);
v15 = *(_DWORD *)(v59 + 56);
v54 = v13;
v16 = v15 + 1;
if( (_DWORD)a4 )
{
v17 = (unsigned int *)(a3 + 20);
v18 = a6;
v58 = v17;
while( 1 )
{
v19 = *(v17 - 3);
v20 = *(v17 - 1);
if( !v19 )
v19 = *(v17 - 1);
v53 = v19;
if( !v20 && *v17 )
{
if( (v8 & 0x10000) != 0 )
{
dword_140C4C958 = 18;
return 3221225595i64;
}
*v17 = 0;
}
if( *v17 + v20 < *v17 )
break;
v7[7] = (INT64)v10;
v7[2] = (INT64)(v7 + 7);
v21 = (INT64)(v7 + 7);
v57 = v21;
if( v14 != *(_QWORD *)v12 + *(v17 - 2) || !v19 )
{
dword_140C4C958 = 20;
return 3221225595i64;
}
if( v13 + v19 - 1 <= v19 )
{
dword_140C4C958 = 21;
return 3221225595i64;
}
v22 = ((v19 + (unsigned __int64)v13 - 1) >> 12) & (~((unsigned __int64)v13 - 1) >> 12);
*(_DWORD *)(v21 + 44) = v22;
if( v22 > v18 )
{
dword_140C4C958 = 22;
return 3221225595i64;
}
v23 = ((v19 + (unsigned __int64)v13 - 1) >> 12) & (~((unsigned __int64)v13 - 1) >> 12);
if( v9 == 1 && v22 != v18 )
{
*(_DWORD *)(v21 + 44) = v18;
v23 = v18;
}
*(_DWORD *)(v21 + 32) = 0;
v24 = *v17 >> 9;
*(_DWORD *)(v21 + 36) = v24;
v52 = v18 - v23;
v25 = -*(_DWORD *)(v12 + 8) & (*(_DWORD *)(v12 + 8) + *v17 + *(v17 - 1) - 1);
if( v25 < *v17 )
{
dword_140C4C958 = 23;
return 3221225595i64;
}
*(_QWORD *)(v21 + 8) = v11;
*(_DWORD *)(v21 + 40) = (v25 >> 9) - v24;
*(_WORD *)(v21 + 34) = 16 * (v25 & 0x1FF);
v26 = v17[4];
v27 = ((unsigned int)v26 >> 29) & 1 | 2;
if( (v26 & 0x40000000) == 0 )
v27 = (v17[4] >> 29) & 1;
v28 = v27 | 4;
if( v26 >= 0 )
v28 = v27;
v29 = v28 | 8;
if( (v26 & 0x10000000) == 0 )
v29 = v28;
v30 = *((char *)MiImageProtectionArray + v29);
if( (*((_BYTE *)MiImageProtectionArray + v29) & 2) != 0 )
*(_BYTE *)(v59 + 50) = 1;
*(_WORD *)(v21 + 32) ^= (*(_WORD *)(v21 + 32) ^ (2 * v30)) & 0x3E;
SubsectionPte = MiMakeSubsectionPte(v21);
DemandZeroPte = MiMakeDemandZeroPte(v32);
if( !*v17 )
SubsectionPte = DemandZeroPte;
v36 = 0;
v51 = *(v17 - 1);
v37 = 0;
v55 = v51 + *v17;
v50 = 0;
if( (v33 & 4) != 0 )
{
if( (v33 & 5) == 5 )
{
v37 = 1;
v51 = *(v17 - 1);
LOBYTE(v50) = 1;
}
else
{
*(_WORD *)(v21 + 34) |= 2u;
v36 = 1;
*((_DWORD *)v10 + 14) |= 0x20000u;
v51 = *(v17 - 1);
HIBYTE(v50) = 1;
}
}
v38 = 0;
v39 = 0;
if( *(_DWORD *)(v57 + 44) )
{
do
{
if( v38 >= v35 )
{
*v11 = ZeroPte;
v10 = a2;
*(_DWORD *)(v57 + 52) ^= (*(_DWORD *)(v57 + 52) ^ (*(_DWORD *)(v57 + 52) + 1)) & 0x3FFFFFFF;
}
else
{
if( v36 == 1 )
++*(_QWORD *)(v56 + 16);
if( v37 == 1 )
++*(_QWORD *)(v56 + 48);
v40 = MiPteInShadowRange((UINT64)v11);
if( v38 >= v51 )
{
v43 = DemandZeroPte;
if( v40
&& (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
&& (DemandZeroPte & 1) != 0 )
{
v43 = DemandZeroPte | 0x8000000000000000ui64;
}
*v11 = v43;
if( !v50 )
++*(_QWORD *)(v56 + 16);
}
else
{
++v10[15];
v41 = SubsectionPte;
if( v40
&& (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
&& (SubsectionPte & 1) != 0 )
{
v41 = SubsectionPte | 0x8000000000000000ui64;
}
*v11 = v41;
}
}
v35 = v53;
v38 += 4096;
v37 = v50;
++v11;
v36 = HIBYTE(v50);
v14 += 4096i64;
++v39;
}
while( v39 < *(_DWORD *)(v57 + 44) );
v8 = v60;
}
v17 = v58 + 10;
v12 = a5;
v42 = v62 == 1;
v9 = --v62;
v58 += 10;
if( v42 )
{
v44 = v52;
v16 = v55;
v15 = *(_DWORD *)(v59 + 56);
goto LABEL_46;
}
v7 = (INT64 *)v57;
v18 = v52;
v13 = v54;
}
dword_140C4C958 = 19;
return 3221225595i64;
}
else
{
v44 = a6;
LABEL_46:
if( v16 > v15 )
{
dword_140C4C958 = 24;
return 3221225595i64;
}
else if( v44 >= *(_DWORD *)(v12 + 12) >> 12 )
{
dword_140C4C958 = 25;
return 3221225595i64;
}
else
{
return 0i64;
}
}
}
}Referenced by:
MiBuildImageControlArea