MiHotPatchProcess

INT64 __fastcall MiHotPatchProcess(struct EX_RUNDOWN_REF *a1, INT64 a2, INT64 a3){
  struct _EX_RUNDOWN_REF *v3; 
  int v5; 
  unsigned int v6; 
  _ETHREAD *CurrentThread; 
  _QWORD *Count; 
  unsigned __int64 i; 
  int v11; 
  __int64 v12; 
  __int64 v13; 
  INT64 v14; 
  INT64 v15; 
  int v16; 
  PVOID v17; 
  _QWORD **v18; 
  unsigned __int64 v19; 
  _QWORD *v20; 
  v3 = a1 + 139;
  v5 = a3;
  v6 = a2;
  if( !ExAcquireRundownProtection(a1 + 139) )
    return 3221225738i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  LOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
LABEL_4:
  Count = (_QWORD *)a1[251].Count;
  i = 0i64;
  while( Count )
  {
    i = (unsigned __int64)Count;
    Count = (_QWORD *)*Count;
  }
  while( i )
  {
    if( (*(_DWORD *)(i + 48) & 0x70) == 32 )
    {
      MiLockVadShared((INT64)CurrentThread, i);
      if( !(unsigned int)MiVadDeleted(i)
        && (v11 = *(_DWORD *)(i + 48), (v11 & 0x100000) == 0)
        && (v11 & 0x70) == 32
        && (v11 & 0x400000) != 0
        && (v12 = **(_QWORD **)(i + 72), v13 = *(_QWORD *)(*(_QWORD *)v12 + 56i64), *(_DWORD *)(v13 + 60) == v6)
        && *(_DWORD *)(v13 + 72) == v5 )
      {
        v14 = _InterlockedCompareExchange64((volatile signed __int64 *)(*(_QWORD *)v12 + 24i64), -1i64, -1i64);
        MiReferenceVad(i);
        MiUnlockVadShared((INT64)CurrentThread, i);
        UNLOCK_ADDRESS_SPACE_SHARED((__int64)CurrentThread, (__int64)a1);
        MiHotPatchImage(v15, v14, i, v6);
        LOCK_ADDRESS_SPACE_SHARED(CurrentThread, (_EPROCESS *)a1);
        MiLockVadShared((INT64)CurrentThread, i);
        v16 = MiVadDeleted(i);
        MiUnlockAndDereferenceVadShared(v17);
        if( v16 )
          goto LABEL_4;
      }
      else
      {
        MiUnlockVadShared((INT64)CurrentThread, i);
      }
    }
    v18 = *(_QWORD ***)(i + 8);
    v19 = i;
    if( v18 )
    {
      v20 = *v18;
      for( i = *(_QWORD *)(i + 8); v20; v20 = (_QWORD *)*v20 )
        i = (unsigned __int64)v20;
    }
    else
    {
      while( 1 )
      {
        i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
        if( !i || *(_QWORD *)i == v19 )
          break;
        v19 = i;
      }
    }
  }
  UNLOCK_ADDRESS_SPACE_SHARED((__int64)CurrentThread, (__int64)a1);
  ExReleaseRundownProtection(v3);
  return 0i64;
}

Referenced by: