MiQueryLoadedPatches

__int64 __fastcall MiQueryLoadedPatches(UINT8 *a1, _QWORD *a2, _DWORD *a3, __int64 a4, int a5){
  _ETHREAD *CurrentThread; 
  INT64 *v6; 
  unsigned __int64 j; 
  _QWORD *v10; 
  _RTL_BALANCED_NODE *UserSidHotPatchContext; 
  unsigned __int64 v13; 
  unsigned int v14; 
  _QWORD *v15; 
  unsigned __int64 i; 
  unsigned __int64 v17; 
  _QWORD **v18; 
  _QWORD *v19; 
  unsigned int v20; 
  int v21; 
  _DWORD *Pool; 
  _DWORD *v23; 
  __int64 v24; 
  _UNICODE_STRING *v25; 
  char *v26; 
  char *v27; 
  wchar_t *v28; 
  unsigned __int16 v29; 
  unsigned __int64 v30; 
  _QWORD **v31; 
  _QWORD *v32; 
  _ETHREAD *v34; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = 0i64;
  j = 0i64;
  v34 = CurrentThread;
  v10 = a2;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockSharedEx(&MiHotPatchListLock, 0i64);
  if( a1 )
  {
    UserSidHotPatchContext = MiFindUserSidHotPatchContext(a1);
    if( UserSidHotPatchContext )
      v6 = (INT64 *)&UserSidHotPatchContext[1];
  }
  else
  {
    v6 = &MiGlobalHotPatchList;
  }
  v13 = 96i64;
  v14 = 0;
  if( v6 )
  {
    v15 = (_QWORD *)*v6;
    j = 0i64;
    while( v15 )
    {
      j = (unsigned __int64)v15;
      v15 = (_QWORD *)*v15;
    }
    i = j;
    while( i )
    {
      ++v14;
      v17 = i;
      v13 += *(unsigned __int16 *)(i + 32) + 24i64;
      v18 = *(_QWORD ***)(i + 8);
      if( v18 )
      {
        v19 = *v18;
        for( i = *(_QWORD *)(i + 8); v19; v19 = (_QWORD *)*v19 )
          i = (unsigned __int64)v19;
      }
      else
      {
        while( 1 )
        {
          i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
          if( !i || *(_QWORD *)i == v17 )
            break;
          v17 = i;
        }
      }
    }
  }
  if( (unsigned int)a5 >= v13 )
  {
    v21 = v13;
    Pool = MiAllocatePool(256i64, (unsigned int)v13, 0x71486D4Dui64);
    v23 = Pool;
    if( !Pool )
    {
      v20 = -1073741670;
      goto LABEL_40;
    }
    *Pool = 2;
    if( a1 )
      RtlCopySid(0x44ui64, Pool + 1, a1);
    if( v14 )
    {
      v24 = v14;
      v25 = (_UNICODE_STRING *)(v23 + 24);
      *((_QWORD *)v23 + 10) = v23 + 24;
      v26 = (char *)v23 - a4;
      v27 = (char *)&v23[4 * v24 + 24];
      *((_QWORD *)v23 + 11) = v27;
      v28 = (wchar_t *)&v27[8 * v24];
      if( j )
      {
        do
        {
          *(_DWORD *)v27 = *(_DWORD *)(j + 24);
          *((_DWORD *)v27 + 1) = *(_DWORD *)(j + 28);
          v29 = *(_WORD *)(j + 32);
          v25->Length = v29;
          v25->MaximumLength = v29;
          v25->Buffer = v28;
          RtlCopyUnicodeString(v25, (PCUNICODE_STRING)(j + 32));
          v25->Buffer = (wchar_t *)((char *)v25->Buffer - v26);
          v27 += 8;
          ++v23[18];
          v30 = j;
          v28 = (wchar_t *)((char *)v28 + v25->Length);
          ++v25;
          v31 = *(_QWORD ***)(j + 8);
          if( v31 )
          {
            v32 = *v31;
            for( j = *(_QWORD *)(j + 8); v32; v32 = (_QWORD *)*v32 )
              j = (unsigned __int64)v32;
          }
          else
          {
            while( 1 )
            {
              j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
              if( !j || *(_QWORD *)j == v30 )
                break;
              v30 = j;
            }
          }
        }
        while( j );
        v27 = (char *)*((_QWORD *)v23 + 11);
        v25 = (_UNICODE_STRING *)*((_QWORD *)v23 + 10);
      }
      v10 = a2;
      *((_QWORD *)v23 + 11) = v27 - v26;
      *((_QWORD *)v23 + 10) = (char *)v25 - v26;
      CurrentThread = v34;
    }
    *v10 = v23;
    *a3 = v21;
  }
  else
  {
    if( v13 > 0xFFFFFFFF )
    {
      v20 = -1073741675;
      goto LABEL_40;
    }
    *v10 = 0i64;
    *a3 = v13;
  }
  v20 = 0;
LABEL_40:
  if( _InterlockedCompareExchange64(&MiHotPatchListLock._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&MiHotPatchListLock);
  KeAbPostRelease(&MiHotPatchListLock);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return v20;
}

Referenced by: