MiProcessLoaderEntry

_QWORD *__fastcall MiProcessLoaderEntry(__int64 *a1, int a2){
  _ETHREAD *CurrentThread; 
  __int64 **v5; 
  bool v6; 
  _QWORD *v7; 
  ULONG_PTR v8; 
  ULONG_PTR v9; 
  _QWORD *v10; 
  __int64 v12; 
  __int64 *v13; 
  UINT8 OldIrql; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  OldIrql = 0;
  --*((_WORD *)CurrentThread + 242);
  ExAcquireResourceExclusiveLite(&PsLoadedModuleResource, 1u);
  if( a2 != 1 )
  {
    if( (MiFlags & 0x80000) == 0 )
      RtlRemoveInvertedFunctionTable((VOID *)a1[6]);
    MmLockLoadedModuleListExclusive(&OldIrql);
    v12 = *a1;
    v13 = (__int64 *)a1[1];
    if( *(__int64 **)(*a1 + 8) == a1 && (__int64 *)*v13 == a1 )
    {
      *v13 = v12;
      *(_QWORD *)(v12 + 8) = v13;
      RtlAvlRemoveNode(&qword_140C4CAA0, a1 + 29);
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)PsLoadedModuleSpinLock);
      __writecr8(OldIrql);
      return MiReleaseResourceLite((__int64)CurrentThread);
    }
LABEL_20:
    __fastfail(3u);
  }
  MmLockLoadedModuleListExclusive(&OldIrql);
  v5 = (__int64 **)*(&PsLoadedModuleList + 1);
  if( *(PVOID **)*(&PsLoadedModuleList + 1) != &PsLoadedModuleList )
    goto LABEL_20;
  *a1 = (__int64)&PsLoadedModuleList;
  v6 = 0;
  a1[1] = (__int64)v5;
  *v5 = a1;
  v7 = (_QWORD *)qword_140C4CAA0;
  *(&PsLoadedModuleList + 1) = a1;
  v8 = a1[6];
  if( qword_140C4CAA0 )
  {
    while( 1 )
    {
      v9 = *(v7 - 23);
      if( v8 <= v9 + (unsigned int)(*((_DWORD *)v7 - 42) - 1) )
      {
        if( v8 >= v9 )
          KeBugCheckEx(0x1Au, 0x2101ui64, v8, (ULONG_PTR)v7, 0i64);
        v10 = (_QWORD *)*v7;
        if( !*v7 )
        {
          v6 = 0;
          break;
        }
      }
      else
      {
        v10 = (_QWORD *)v7[1];
        if( !v10 )
        {
          v6 = 1;
          break;
        }
      }
      v7 = v10;
    }
  }
  RtlAvlInsertNodeEx(&qword_140C4CAA0, (__int64)v7, v6, a1 + 29);
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)PsLoadedModuleSpinLock);
  __writecr8(OldIrql);
  if( (MiFlags & 0x80000) == 0 )
    RtlInsertInvertedFunctionTable((PVOID)a1[6], *((unsigned int *)a1 + 16));
  return MiReleaseResourceLite((__int64)CurrentThread);
}

Referenced by: