MiParseComAndCetHeaders

INT64 __fastcall MiParseComAndCetHeaders(INT64 *a1, UINT64 *a2, BYTE *a3){
  unsigned int v6; 
  __int64 v7; 
  unsigned int v8; 
  unsigned int v9; 
  unsigned int v10; 
  _FILE_OBJECT *v12; 
  INT64 v13; 
  __int64 v14; 
  int v15; 
  __int64 v16; 
  char v17; 
  char v18; 
  INT64 v19; 
  unsigned int i; 
  __int64 v21; 
  unsigned int v22; 
  int v23; 
  unsigned int v24; 
  NTSTATUS v25; 
  _FILE_OBJECT *v26; 
  unsigned int v27; 
  INT64 v28; 
  __int64 v29; 
  INT64 result[10]; 
  __int128 v31; 
  __int128 v32; 
  __int128 v33; 
  __int128 v34; 
  __int64 v35; 
  memset((INT64)result, 0i64);
  v6 = 0;
  v26 = 0i64;
  *a3 = 0;
  v7 = *((unsigned int *)a2 + 20);
  if( (_DWORD)v7 )
  {
    if( (v7 & 3) == 0 )
    {
      v8 = *((_DWORD *)a2 + 21);
      if( v8 >= 0x48
        && (unsigned int)v7 + v8 > (unsigned int)v7
        && v7 + 72 <= (unsigned __int64)*((unsigned int *)a2 + 4) )
      {
        v6 = 1;
      }
    }
  }
  v9 = *((_DWORD *)a2 + 26);
  if( v9 )
  {
    if( (v9 & 3) == 0 )
    {
      v10 = *((_DWORD *)a2 + 27);
      if( v10 >= 0x1C && v10 + v9 > v9 && v10 + v9 <= *((_DWORD *)a2 + 4) )
        v6 |= 2u;
    }
  }
  if( !v6 )
    return 0i64;
  v25 = MiMapImageInSystemSpace((__int64)a1, 3, (__int64)result);
  if( v25 >= 0 )
  {
    v12 = MiReferenceControlAreaFile((_CONTROL_AREA *)a1);
    v26 = v12;
    v6 |= 0xCu;
    v13 = *a1;
    v28 = result[0];
    if( (v6 & 1) != 0 )
    {
      v14 = *((unsigned int *)a2 + 20);
      v31 = *(_OWORD *)(result[0] + v14);
      v32 = *(_OWORD *)(result[0] + v14 + 16);
      v33 = *(_OWORD *)(result[0] + v14 + 32);
      v34 = *(_OWORD *)(result[0] + v14 + 48);
      v35 = *(_QWORD *)(result[0] + v14 + 64);
      MiLogRelocationRva(v14, 0x48u, v12, (__int64)a1);
      v15 = v32;
      if( (v32 & 1) != 0 )
      {
        *a3 = 1;
        *(_BYTE *)(v13 + 15) |= 1u;
        if( WORD2(v31) > 2u || WORD2(v31) == 2 && WORD3(v31) >= 5u )
        {
          v16 = *(_QWORD *)(v13 + 56);
          v17 = *(_BYTE *)(v16 + 51) | 2;
          *(_BYTE *)(v16 + 51) = v17;
          if( (v15 & 0x20002) != 2 && (*(_BYTE *)(v13 + 14) & 0x40) != 0 )
          {
            v18 = v17 | 1;
            *(_BYTE *)(v16 + 51) = v18;
            if( (v15 & 0x20000) != 0 )
              *(_BYTE *)(v16 + 51) = v18 | 0x20;
          }
        }
      }
    }
    if( (v6 & 2) != 0 )
    {
      v19 = v28 + *((unsigned int *)a2 + 26);
      for( i = 0; ; i = v27 + 1 )
      {
        v27 = i;
        v21 = (*((unsigned int *)a2 + 27) * (unsigned __int128)0x2492492492492493ui64) >> 64;
        if( i >= (v21 + (((unsigned __int64)*((unsigned int *)a2 + 27) - v21) >> 1)) >> 4 )
          break;
        MiLogRelocationRva(*((_DWORD *)a2 + 26) + 28 * i, 0x1Cu, v26, (__int64)a1);
        v29 = *(_QWORD *)(v19 + 16);
        if( HIDWORD(*(_OWORD *)v19) == 20 )
        {
          if( !HIDWORD(v29) )
            break;
          if( (v29 & 0x300000000i64) != 0 )
            break;
          if( !(_DWORD)v29 )
            break;
          if( (v29 & 3) != 0 )
            break;
          v22 = *((_DWORD *)a2 + 4);
          if( (unsigned int)v29 >= v22 || HIDWORD(v29) >= v22 || HIDWORD(v29) + (int)v29 >= v22 )
            break;
          MiLogRelocationRva(HIDWORD(v29), 4u, v26, (__int64)a1);
          v23 = *(_DWORD *)(v28 + HIDWORD(v29));
          if( (v23 & 1) != 0 )
            *(_DWORD *)(*(_QWORD *)(v13 + 56) + 76i64) |= 1u;
          if( (v23 & 2) != 0 )
            *(_DWORD *)(*(_QWORD *)(v13 + 56) + 76i64) |= 2u;
          if( (v23 & 4) != 0 )
            *(_DWORD *)(*(_QWORD *)(v13 + 56) + 76i64) |= 4u;
          if( (v23 & 8) != 0 )
            *(_DWORD *)(*(_QWORD *)(v13 + 56) + 76i64) |= 8u;
          if( (v23 & 0x10) != 0 )
            *(_DWORD *)(*(_QWORD *)(v13 + 56) + 76i64) |= 0x10u;
          v24 = v25;
          if( (v23 & 0x20) != 0 )
            *(_DWORD *)(*(_QWORD *)(v13 + 56) + 76i64) |= 0x20u;
          goto LABEL_50;
        }
        v19 += 28i64;
      }
    }
  }
  v24 = v25;
LABEL_50:
  if( (v6 & 4) != 0 )
    MiUnmapImageInSystemSpace((INT64)result);
  if( v6 >= 8 )
    MiDereferenceControlAreaFile((__int64)a1, (unsigned __int64)v26);
  return v24;
}

Referenced by: