MmLoadSystemImageEx

INT64 __fastcall MmLoadSystemImageEx(
        UNICODE_STRING *a1,
        UNICODE_STRING *NamePrefix,
        UNICODE_STRING *LoadedBaseName,
        UINT64 a4,
        INT64 a5,
        INT64 a6){
  unsigned int v6; 
  _EJOB *v10; 
  int v11; 
  signed int active; 
  unsigned int v13; 
  int v14; 
  char *v15; 
  _SECTION *v16; 
  _CONTROL_AREA *v17; 
  unsigned int v18; 
  int v19; 
  PVOID v20; 
  _ETHREAD *v21; 
  UNICODE_STRING *v22; 
  __int64 *v23; 
  char v24; 
  int v25; 
  PVOID v26; 
  VOID *v27; 
  CHAR *v28; 
  CHAR *v29; 
  UINT v30; 
  int inserted; 
  _CONTROL_AREA *v32; 
  void *PatchTableProtos; 
  IMAGE_NT_HEADERS *v35; 
  INT64 v36; 
  INT64 v37; 
  int v38; 
  int TimeDateStamp; 
  PVOID v40; 
  _FILE_OBJECT *v41; 
  __int64 v42; 
  unsigned __int64 v43; 
  char v44; 
  char *v45; 
  _QWORD *v46; 
  INT64 v47; 
  WCHAR v48; 
  PVOID v49; 
  char v50; 
  char v51[3]; 
  UINT64 UnloadFlags; 
  char v53; 
  UINT v54; 
  _ETHREAD *CurrentThread; 
  UINT SharePages; 
  PVOID v57; 
  PVOID VirtualAddress; 
  PVOID P; 
  PVOID Object; 
  __int64 *v61; 
  UNICODE_STRING String1; 
  char *v63; 
  _EJOB *PreviousSilo; 
  PVOID PrefixedImageName[2]; 
  UNICODE_STRING BaseDirectory; 
  INT64 result[11]; 
  UNICODE_STRING v68; 
  unsigned int CheckSum; 
  int v70; 
  CHAR v73; 
  v63 = 0i64;
  v6 = a4;
  v57 = 0i64;
  v73 = 0;
  PreviousSilo = 0i64;
  v53 = 0;
  v54 = 1;
  SharePages = 1;
  *(_OWORD *)PrefixedImageName = 0i64;
  String1 = 0i64;
  *(_QWORD *)a6 = 0i64;
  BaseDirectory = 0i64;
  if( *((_BYTE *)PsGetCurrentServerSiloGlobals() + 1176) )
  {
    v10 = (_EJOB *)HalSystemVectorDispatchEntry();
    PreviousSilo = PsAttachSiloToCurrentThread(v10);
    v53 = 1;
  }
  v11 = v6 & 1;
  if( (v6 & 1) == 0 )
  {
    if( (v6 & 4) == 0 )
      goto LABEL_10;
LABEL_5:
    active = -1073741582;
    goto LABEL_66;
  }
  if( (v6 & 2) != 0 || (v6 & 0x80000004) == 4 )
    goto LABEL_5;
  if( (*(_DWORD *)(PsGetCurrentProcess() + 1124) & 0x10000) == 0 )
  {
    active = -1073741801;
    goto LABEL_66;
  }
LABEL_10:
  active = MiGenerateSystemImageNames(
             a1,
             NamePrefix,
             LoadedBaseName,
             &String1,
             &BaseDirectory,
             (UNICODE_STRING *)PrefixedImageName);
  if( active < 0 )
    goto LABEL_66;
  v13 = 0;
  P = 0i64;
  v51[0] = 1;
  v50 = 0;
  UnloadFlags = 0x100000000i64;
  CurrentThread = MmAcquireLoadLock();
  v14 = MiObtainSectionForDriver((PCUNICODE_STRING)PrefixedImageName, a1, 0i64, v6, &P);
  v15 = (char *)P;
  active = v14;
  if( v14 < 0 )
    goto LABEL_116;
  v16 = (_SECTION *)*((_QWORD *)P + 14);
  Object = v16;
  if( v16 )
  {
    v17 = MiSectionControlArea(v16);
    v18 = *(_DWORD *)(*(_QWORD *)v17 + 8i64);
  }
  else
  {
    v17 = 0i64;
    v18 = 0;
  }
  if( active )
  {
    v23 = (__int64 *)(v15 + 48);
    v20 = (PVOID)*((_QWORD *)v15 + 6);
    VirtualAddress = v20;
    v61 = (__int64 *)(v15 + 48);
    if( (v6 & 1) != 0 )
    {
      inserted = MiSessionInsertImage((unsigned __int64)v20, (__int64)v17);
      active = inserted;
      if( inserted < 0 )
      {
LABEL_37:
        MmReleaseLoadLock(CurrentThread);
        goto LABEL_61;
      }
      if( inserted == 272 )
      {
LABEL_42:
        *(_QWORD *)a5 = v15;
        *(_QWORD *)a6 = v20;
        if( (*((_DWORD *)v15 + 26) & 0x4000000) != 0 )
          active = -1073741411;
        else
          active = v11 == 0 ? 0xC000010E : 0;
        goto LABEL_37;
      }
      v23 = v61;
      v24 = 1;
      v50 = 1;
    }
    else
    {
      v24 = 0;
    }
    if( active != 272 )
    {
      ++*((_WORD *)v15 + 54);
      LOBYTE(v19) = 0;
      goto LABEL_46;
    }
    goto LABEL_42;
  }
  v19 = 1;
  v73 = 1;
  *((_DWORD *)v15 + 16) = v18 << 12;
  VirtualAddress = (PVOID)MiGetSystemAddressForImage(v16, v6, &SharePages);
  v20 = VirtualAddress;
  if( !VirtualAddress )
  {
    ObDereferenceObjectDeferDelete(Object);
    ExFreePoolWithTag(v15, 0);
    v21 = CurrentThread;
    active = -1073741670;
    v22 = a1;
LABEL_59:
    MmReleaseLoadLock(v21);
    if( !v51[0] )
      MiLogFailedDriverLoad(v22, 0i64, 0i64, (unsigned int)active, (INT64)v49);
    goto LABEL_61;
  }
  MiCheckPurgeAndUpMapCount((__int64)v17);
  v23 = (__int64 *)(v15 + 48);
  v24 = v6 & 1;
  v61 = (__int64 *)(v15 + 48);
  *((_QWORD *)v15 + 6) = v20;
  v50 = v6 & 1;
  if( !(_BYTE)v11 )
  {
    v25 = MiControlAreaRequiresCharge((INT64)v17);
    HIDWORD(UnloadFlags) = v25;
    if( !v25 )
    {
      active = -1073740277;
LABEL_52:
      v13 = UnloadFlags;
LABEL_53:
      v21 = CurrentThread;
      v22 = a1;
      goto LABEL_54;
    }
    if( v25 == 2 )
    {
      active = MiReferenceActiveSubsection((ULONG_PTR)v17 + 128, 136, 0x11u);
      if( active < 0 )
      {
        v13 = UnloadFlags;
        v25 = 1;
        v21 = CurrentThread;
        v22 = a1;
        goto LABEL_112;
      }
    }
    v54 = SharePages;
    goto LABEL_25;
  }
  v54 = SharePages;
LABEL_46:
  if( v24 != 1 || !dword_140C4C9F0 )
  {
LABEL_25:
    v26 = v57;
    goto LABEL_26;
  }
  if( (_BYTE)v19 == 1 )
  {
    if( !(unsigned int)MiCreateSessionDriverProtos((__int64 *)v17, *v23, 0i64)
      || (PatchTableProtos = MiCreatePatchTableProtos(), (v57 = PatchTableProtos) == 0i64) )
    {
      active = -1073741670;
      goto LABEL_51;
    }
    v26 = PatchTableProtos;
  }
  else
  {
    v26 = (PVOID)*((_QWORD *)v15 + 36);
    v57 = v26;
  }
LABEL_26:
  active = MiMapSystemImage((_SECTION *)Object, v20, (UINT64)v26);
  if( active < 0 )
  {
LABEL_51:
    v25 = HIDWORD(UnloadFlags);
    goto LABEL_52;
  }
  if( (v6 & 1) == 0 )
  {
    _InterlockedExchangeAdd(&dword_140C4ED10, v18);
    v15 = (char *)P;
    v54 = SharePages;
  }
  v27 = VirtualAddress;
  v28 = 0i64;
  LODWORD(UnloadFlags) = 1;
  if( (v6 & 0x21) == 0
    && VirtualAddress == *(PVOID *)(*(_QWORD *)v17 + 32i64)
    && (unsigned int)MiUseLargeDriverPage(&String1)
    && (v29 = MiMapSystemImageWithLargePage((INT64)Object, v18, v27), (v28 = v29) != 0i64) )
  {
    _InterlockedExchangeAdd((_DWORD *)&xmmword_140C4CA88 + 3, -v18);
    v30 = SharePages;
    v27 = v29;
    v15 = (char *)P;
    VirtualAddress = v29;
    v54 = SharePages;
    *v61 = (__int64)v29;
  }
  else
  {
    v30 = v54;
  }
  v51[0] = 0;
  if( v73 != 1 )
    goto LABEL_84;
  v35 = RtlImageNtHeader(v27);
  if( !v35 )
  {
    active = -1073741279;
    goto LABEL_51;
  }
  if( v35->FileHeader.Machine != 0x8664 || v35->OptionalHeader.Magic != 523 )
  {
    active = -1073741520;
    goto LABEL_51;
  }
  if( (MiFlags & 0x10000) == 0
    || (MiValidateStrongCodeDriverImage(v35, (_BYTE *)v6, v36, v37, (INT64)v49), active = v38, v38 >= 0) )
  {
    v30 = v54;
    active = MiConstructLoaderEntry(
               (__int64)v15,
               (const void **)&String1,
               (const void **)PrefixedImageName,
               v6,
               v54,
               (__int64 *)&v63);
    if( active < 0 )
      goto LABEL_51;
    ExFreePoolWithTag(v15, 0);
    v40 = v57;
    v15 = v63;
    if( v57 )
    {
      v57 = 0i64;
      *((_QWORD *)v63 + 36) = v40;
    }
LABEL_84:
    LODWORD(UnloadFlags) = 5;
    if( HIDWORD(UnloadFlags) == 2 )
      *((_DWORD *)v15 + 49) |= 0x80u;
    if( !v28 && (v6 & 1) == 0 )
    {
      if( !v30 )
        goto LABEL_93;
      v41 = MiReferenceControlAreaFile(v17);
      IoIsDeviceEjectable(v41->DeviceObject);
      if( v44 || (*(_DWORD *)(v42 + 52) & 0x11) != 0 )
        v30 = 0;
      MiDereferenceControlAreaFile((__int64)v17, v43);
      if( !v30 )
LABEL_93:
        MiBackSingleImageWithPagefile((__int64)v15);
    }
    active = MiResolveImageImports((_KLDR_DATA_TABLE_ENTRY *)v15, (INT64)NamePrefix, &BaseDirectory, &String1, v51);
    if( active < 0
      || (active = MiProcessLoadConfigForDriver((_KLDR_DATA_TABLE_ENTRY *)v15, (_SUBSECTION *)((char *)v17 + 128)),
          active < 0)
      || (active = MiFinalizeImageRetpolineState((INT64)v15), active < 0) )
    {
      v13 = UnloadFlags;
    }
    else
    {
      v45 = (char *)VirtualAddress;
      if( (*(_BYTE *)(*(_QWORD *)(*(_QWORD *)v17 + 56i64) + 46i64) & 0x40) == 0 )
      {
        v46 = (char *)VirtualAddress + *(unsigned int *)(*(_QWORD *)(*((_QWORD *)v17 + 12) + 32i64) + 64i64);
        MiSetImageProtection((_KLDR_DATA_TABLE_ENTRY *)v15, v46, 8ui64, 4ui64);
        *v46 = &v45[-MiRelocateAmount((__int64)v17)];
        if( *((_QWORD *)v17 + 18) )
          MiSetImageProtection((_KLDR_DATA_TABLE_ENTRY *)v15, v46, 8ui64, 0x100ui64);
      }
      active = MiFinalizeDriverImage((__int64)v15);
      v13 = 23;
      if( active >= 0 )
      {
        active = MiApplyImportOptimizationToRuntimeDriver((INT64)v15, (UINT64)v17);
        if( active >= 0 )
        {
          if( v50 != 1 || (v6 & 4) == 0 || (active = MiCompactServiceTable((_KLDR_DATA_TABLE_ENTRY *)v15), active >= 0) )
          {
            active = MiHandleDriverNonPagedSections((__int64)v15, v6, 1);
            if( active >= 0 )
            {
              v13 = 31;
              if( v50 == 1 )
                MiSessionApplyNonPagedImageCharges(v45);
              active = MiFinalizeDriverCfgState((INT64)v15, v6, (INT64)v17 + 128);
              if( active >= 0 )
              {
                active = MiApplyRequiredDriverHotPatches((INT64)v15, v47, v48);
                if( active >= 0 )
                {
                  v22 = a1;
                  MiDriverLoadSucceeded((INT64)v15, (INT64)Object, a1, (INT64)PrefixedImageName, (INT64)&String1, v73);
                  v21 = CurrentThread;
                  MmReleaseLoadLock(CurrentThread);
                  active = 0;
                  *(_QWORD *)a5 = v15;
                  *(_QWORD *)a6 = v45;
                  goto LABEL_111;
                }
              }
            }
          }
        }
      }
    }
LABEL_116:
    v25 = HIDWORD(UnloadFlags);
    goto LABEL_53;
  }
  memset((INT64)result, 0i64);
  CheckSum = v35->OptionalHeader.CheckSum;
  TimeDateStamp = v35->FileHeader.TimeDateStamp;
  v68 = String1;
  v70 = TimeDateStamp;
  MiLogStrongCodeDriverLoadFailure("SectionWXable", (__int64)result);
  v13 = UnloadFlags;
  v21 = CurrentThread;
  v22 = a1;
LABEL_111:
  v25 = HIDWORD(UnloadFlags);
LABEL_112:
  if( active < 0 )
  {
LABEL_54:
    if( v15 )
    {
      if( v25 == 2 && (v13 & 4) == 0 )
      {
        v32 = MiSectionControlArea(*((_SECTION **)v15 + 14));
        MiReturnCrossPartitionControlAreaCharges((INT64)v32);
      }
      MiUnloadSystemImage(v15, v13);
    }
    goto LABEL_59;
  }
LABEL_61:
  if( NamePrefix )
    ExFreePoolWithTag(PrefixedImageName[1], 0);
  if( v73 == 1 && v57 )
    MiFreePatchTableProtos(v57);
LABEL_66:
  if( v53 )
    PsDetachSiloFromCurrentThread(PreviousSilo);
  return(unsigned int)active;
}

Referenced by: