NtManageHotPatch

__int64 __fastcall NtManageHotPatch(unsigned int a1, VOID *a2, unsigned int a3, unsigned __int64 a4){
  INT64 v4; 
  __int64 v7; 
  char PreviousMode; 
  int active; 
  int v10; 
  INT64 v11; 
  unsigned __int64 v12; 
  const VOID *v13; 
  UINT8 *v14; 
  unsigned int v15; 
  unsigned __int64 v16; 
  unsigned int v17; 
  _DWORD *v18; 
  __int64 v19; 
  _KPROCESSOR_MODE AccessMode; 
  int v22; 
  size_t v24; 
  int v25; 
  size_t Size[2]; 
  unsigned __int64 v27; 
  PVOID P; 
  PVOID v29; 
  _UNICODE_STRING DestinationString; 
  INT64 Src[14]; 

  v4 = a3;
  v27 = a4;
  DestinationString = 0i64;
  LODWORD(v7) = 104;
  *(_QWORD *)Size = 104i64;
  memset(Src, 0i64, 0x68u);
  P = 0i64;
  v29 = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  v24 = 0;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( !dword_140C4C9F0 )
  {
    active = -1073741637;
LABEL_3:
    v22 = active;
    goto LABEL_78;
  }
  if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeLoadDriverPrivilege, PreviousMode) )
  {
    active = -1073741727;
    goto LABEL_3;
  }
  v10 = 0;
  v25 = 0;
  switch( a1 )
  {
    case 0u:
      goto LABEL_16;
    case 1u:
      goto LABEL_20;
    case 2u:
      goto LABEL_19;
  }
  if( a1 != 3 )
  {
    if( a1 != 4 )
    {
      if( a1 != 5 )
      {
        if( a1 != 6 )
        {
          active = -1073741821;
          goto LABEL_3;
        }
        v7 = 40i64;
        goto LABEL_15;
      }
LABEL_19:
      v7 = 96i64;
LABEL_15:
      *(_QWORD *)Size = v7;
      goto LABEL_16;
    }
LABEL_20:
    LODWORD(v7) = 80;
    *(_QWORD *)Size = 80i64;
    v10 = 1;
    v11 = 4i64;
    v25 = 1;
    goto LABEL_17;
  }
LABEL_16:
  v11 = 8i64;
LABEL_17:
  if( (unsigned int)v4 < (unsigned int)v7 )
  {
    active = -1073741820;
    goto LABEL_3;
  }
  if( PreviousMode )
  {
    v12 = a4;
    if( a4 >= 0x7FFFFFFF0000i64 )
      v12 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v12 = *(_DWORD *)v12;
    if( v10 )
    {
      if( (_DWORD)v4 )
      {
        if( (((_DWORD)v11 - 1) & (unsigned int)a2) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)a2 + v4 > 0x7FFFFFFF0000i64 || (char *)a2 + v4 < a2 )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
    }
    else
    {
      ProbeForWrite((UINT64)a2, v4, v11);
    }
    memmove(Src, a2, Size[0]);
  }
  else
  {
    memmove(Src, a2, v7);
  }
  switch( a1 )
  {
    case 0u:
      goto LABEL_61;
    case 1u:
      goto LABEL_54;
    case 2u:
      goto LABEL_45;
    case 3u:
LABEL_61:
      if( LODWORD(Src[0]) != 2 || !LOWORD(Src[1]) )
        goto LABEL_46;
      if( PreviousMode )
      {
        if( (Src[2] & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v16 = Src[2] + LOWORD(Src[1]);
        if( v16 > 0x7FFFFFFF0000i64 || v16 < Src[2] )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      active = RtlDuplicateUnicodeString(0i64, (_UNICODE_STRING *)&Src[1], &DestinationString);
      v22 = active;
      if( active < 0 )
        goto LABEL_78;
      if( a1 == 3 )
      {
        if( !RtlValidSid(&Src[3]) )
          goto LABEL_49;
        v17 = MiLoadHotPatchForUserSid(&DestinationString, &Src[3], (INT64 *)((char *)&Src[11] + 4));
      }
      else
      {
        v17 = MiLoadHotPatch(&DestinationString);
      }
      v22 = v17;
      active = v17;
      MiLogHotPatchManagement(a1, (INT64)Src, &DestinationString.Length, v17);
      v13 = Src;
      v24 = Size[0];
      goto LABEL_74;
    case 4u:
LABEL_54:
      if( LODWORD(Src[0]) != 1 )
        goto LABEL_46;
      if( a1 == 4 )
      {
        if( !RtlValidSid((_BYTE *)&Src[1] + 4) )
          goto LABEL_49;
        v15 = MiUnloadHotPatchForUserSid((char *)&Src[1] + 4, (INT64 *)((char *)Src + 4));
      }
      else
      {
        v15 = MiUnloadHotPatch(HIDWORD(Src[0]), LODWORD(Src[1]));
      }
      v22 = v15;
      active = v15;
      MiLogHotPatchManagement(a1, (INT64)Src, 0i64, v15);
      v13 = 0i64;
      goto LABEL_74;
  }
  if( a1 != 5 )
  {
    LOBYTE(AccessMode) = PreviousMode;
    active = MiQueryProcessActivePatches(Src[1], (INT64 *)&v29, &v24, (__int64)a2, v4, AccessMode);
    v22 = active;
    if( active < 0 )
      goto LABEL_78;
    if( v24 > (unsigned int)v4 )
      goto LABEL_42;
    v13 = v29;
    goto LABEL_74;
  }
LABEL_45:
  if( LODWORD(Src[0]) != 2 )
  {
LABEL_46:
    active = -1073741811;
    goto LABEL_43;
  }
  v14 = 0i64;
  if( a1 == 5 )
  {
    if( !RtlValidSid((_BYTE *)Src + 4) )
    {
LABEL_49:
      active = -1073741704;
      goto LABEL_43;
    }
    v14 = (UINT8 *)Src + 4;
  }
  active = MiQueryLoadedPatches(v14, &P, &v24, (__int64)a2, v4);
  v22 = active;
  if( active < 0 )
    goto LABEL_78;
  if( v24 > (unsigned int)v4 )
  {
LABEL_42:
    active = -1073741789;
LABEL_43:
    v22 = active;
    goto LABEL_78;
  }
  v13 = P;
LABEL_74:
  if( !v25 )
  {
    if( PreviousMode )
    {
      memmove(a2, v13, v24);
      v18 = (_DWORD *)a4;
      goto LABEL_79;
    }
    memmove(a2, v13, v24);
  }
LABEL_78:
  v18 = (_DWORD *)a4;
LABEL_79:
  if( PreviousMode )
  {
    v19 = (__int64)v18;
    if( (unsigned __int64)v18 >= 0x7FFFFFFF0000i64 )
      v19 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v19 = *(_DWORD *)v19;
    *v18 = v24;
    active = v22;
  }
  else
  {
    *v18 = v24;
  }
  RtlFreeAnsiString(&DestinationString);
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v29 )
    ExFreePoolWithTag(v29, 0);
  return(unsigned int)active;
}

Referenced by: