MiLoadHotPatchForUserSid

NTSTATUS __stdcall MiLoadHotPatchForUserSid(_UNICODE_STRING *a1, VOID *a2, INT64 *a3){
  NTSTATUS v6; 
  _RTL_BALANCED_NODE *HotPatchRecord; 
  _ETHREAD *CurrentThread; 
  __int64 v9; 
  _RTL_BALANCED_NODE *Root; 
  char v11; 
  BOOL v12; 
  int v13; 
  _RTL_BALANCED_NODE *v14; 
  _RTL_BALANCED_NODE *Pool; 
  _RTL_BALANCED_NODE *v16; 
  PADAPTER_OBJECT DmaAdapter; 
  VOID *Handle; 
  __int128 v20; 
  ULONG DestinationSidLength; 

  Handle = 0i64;
  DmaAdapter = 0i64;
  v20 = 0i64;
  v6 = MiOpenHotPatchFile(a1, 1, 0, &Handle, (_SECTION **)&DmaAdapter, 0i64, a3, 0i64);
  if( v6 < 0 )
    goto LABEL_23;
  HotPatchRecord = (_RTL_BALANCED_NODE *)MiAllocateHotPatchRecord(*(_DWORD *)a3, *((_DWORD *)a3 + 1), (const VOID **)a1);
  if( !HotPatchRecord )
  {
    v6 = -1073741670;
    goto LABEL_23;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  DestinationSidLength = RtlLengthSid((INT64)a2);
  LODWORD(v9) = RtlHashBytes2((const UINT8 *)a2, DestinationSidLength);
  *(_QWORD *)&v20 = v9;
  *((_QWORD *)&v20 + 1) = a2;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&MiHotPatchListLock, 0i64);
  Root = MiUserSidPatchLists.Root;
  v11 = 0;
  v12 = 0;
  if( !MiUserSidPatchLists.Root )
    goto LABEL_12;
  while( 1 )
  {
    v13 = MiCompareUserSidHotPatchNodes(&v20, (__int64)Root);
    if( v13 <= 0 )
      break;
    v14 = Root->Children[1];
    if( !v14 )
    {
      v12 = 1;
      goto LABEL_13;
    }
LABEL_10:
    Root = v14;
  }
  if( v13 < 0 )
  {
    v14 = Root->Children[0];
    if( !Root->Children[0] )
      goto LABEL_13;
    goto LABEL_10;
  }
  v11 = 1;
LABEL_12:
  if( !v11 )
  {
LABEL_13:
    Pool = (_RTL_BALANCED_NODE *)MiAllocatePool(256i64, DestinationSidLength + 40, 0x73486D4Dui64);
    v16 = Pool;
    if( !Pool )
    {
      if( (_InterlockedExchangeAdd64(&MiHotPatchListLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(&MiHotPatchListLock);
      KeAbPostRelease(&MiHotPatchListLock);
      KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
      v6 = -1073741670;
      goto LABEL_21;
    }
    Pool[1].Children[0] = 0i64;
    Pool[1].Children[1] = (_RTL_BALANCED_NODE *)v20;
    RtlCopySid(DestinationSidLength, &Pool[1].16, a2);
    RtlAvlInsertNodeEx(&MiUserSidPatchLists.Root, (UINT64)Root, v12, v16);
    Root = v16;
  }
  MiInsertHotPatchRecord(Root[1].Children, HotPatchRecord, 1i64);
  if( (_InterlockedExchangeAdd64(&MiHotPatchListLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&MiHotPatchListLock);
  KeAbPostRelease(&MiHotPatchListLock);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  HotPatchRecord = 0i64;
  MiHotPatchAllProcesses(*(unsigned int *)a3, *((unsigned int *)a3 + 1));
  v6 = 0;
LABEL_21:
  if( HotPatchRecord )
    ExFreePoolWithTag(HotPatchRecord, 0);
LABEL_23:
  if( DmaAdapter )
    HalPutDmaAdapter(DmaAdapter);
  if( Handle )
    ObCloseHandle(Handle, 0);
  return v6;
}

Referenced by: