MiProtectSystemImage

unsigned __int64 __fastcall MiProtectSystemImage(__int64 a1){
  char *v1; 
  unsigned __int64 result; 
  IMAGE_NT_HEADERS *v4; 
  int v5; 
  __int64 NumberOfSections; 
  int v7; 
  __int128 *v8; 
  __int64 v9; 
  unsigned int *v10; 
  unsigned __int64 v11; 
  unsigned int v12; 
  char *v13; 
  char *v14; 
  unsigned __int64 v15; 
  int v16; 
  char *v17; 
  unsigned int v18; 
  MMPTE *v19; 
  unsigned int v20; 
  void *v21; 
  UINT64 v22; 
  unsigned int v23; 
  int v24; 
  unsigned int v25; 
  unsigned __int64 v26; 
  unsigned __int64 v27; 
  unsigned int v28; 
  unsigned __int64 v29; 
  unsigned __int64 v30; 
  unsigned __int64 v31; 
  __int64 SectionAlignment; 
  __int64 v33; 
  unsigned int v34; 
  MMPTE *v35; 
  unsigned int SectionProtection; 
  unsigned int SectionProtection_4; 
  unsigned int v38; 
  int v39; 
  MMPTE *PteAddress; 
  MMPTE *v41; 
  unsigned __int64 v42; 
  char *v44; 
  __int128 v45[2]; 
  __int64 v46; 
  v1 = *(char **)(a1 + 48);
  memset(v45, 0, sizeof(v45));
  v46 = 0i64;
  result = MI_IS_PHYSICAL_ADDRESS(v1);
  if( (_DWORD)result )
  {
    if( v1 == (char *)PsNtosImageBase || v1 == PsHalImageBase )
      return MiActOnLargeKernelHalPages(v1, (__int64(__fastcall *)(char *, char *))MiProtectLargeKernelHalRange);
  }
  else
  {
    SectionProtection_4 = 0;
    v4 = RtlImageNtHeader(v1);
    v5 = 0;
    if( (unsigned int)MiGetSystemRegionType((UINT64)v1) == 1 )
    {
      SectionProtection_4 = 1;
    }
    else if( (*(_DWORD *)(a1 + 104) & 0x8000000) == 0 )
    {
      v5 = 1;
    }
    NumberOfSections = v4->FileHeader.NumberOfSections;
    v7 = v4->FileHeader.NumberOfSections;
    v8 = (__int128 *)((char *)&v4->OptionalHeader + v4->FileHeader.SizeOfOptionalHeader);
    v9 = (v4->OptionalHeader.SizeOfImage >> 12) + ((v4->OptionalHeader.SizeOfImage & 0xFFF) != 0);
    result = (unsigned __int64)v1;
    if( v4->FileHeader.NumberOfSections )
    {
      v10 = (unsigned int *)(v8 + 1);
      while( 1 )
      {
        v11 = (unsigned __int64)&v1[*(v10 - 1)];
        if( v11 < result )
          break;
        v12 = *v10;
        if( *v10 < *(v10 - 2) )
          v12 = *(v10 - 2);
        v10 += 10;
        result = -(__int64)v4->OptionalHeader.SectionAlignment & (v11 + v4->OptionalHeader.SectionAlignment + v12 - 1i64);
        if( !--v7 )
          goto LABEL_11;
      }
    }
    else
    {
LABEL_11:
      v39 = -1073741824;
      v44 = (char *)v8 + 40 * NumberOfSections - 1;
      PteAddress = MiGetPteAddress(v1);
      SectionProtection = 0;
      v14 = (char *)PteAddress + 8 * v9;
      v15 = 0i64;
      v41 = 0i64;
      v16 = NumberOfSections + 1;
      v42 = (unsigned __int64)v14;
      do
      {
        if( v16 == 1 )
        {
          HIDWORD(v46) = 0;
          v8 = v45;
          v17 = 0i64;
          v38 = 0;
          v19 = (MMPTE *)((char *)MiGetPteAddress(v13) + 8);
        }
        else
        {
          v17 = &v1[*((unsigned int *)v8 + 3)];
          v19 = MiGetPteAddress(v17);
          if( v20 < v18 )
            v20 = v18;
          v22 = SectionProtection;
          v38 = v20;
        }
        if( v15 && (unsigned __int64)v19 > v15 )
        {
          v34 = MiComputeDriverProtection(SectionProtection_4, v22);
          MiSetSystemCodeProtection(a1, v15, v15, v34);
          v21 = v44;
          v35 = (MMPTE *)((char *)PteAddress + 8);
          if( (MMPTE *)v15 != PteAddress )
            v35 = PteAddress;
          PteAddress = v35;
          v41 = 0i64;
          SectionProtection = 0;
        }
        if( (unsigned __int64)v19 >= v42 )
        {
          result = (unsigned __int64)v45;
          if( v8 != v45 )
            break;
        }
        v23 = *((_DWORD *)v8 + 9) & 0xE0000000;
        if( v5 == 1 && ((MiFlags & 0x10000) == 0 || (*((_DWORD *)v8 + 9) & 0x20000000) == 0) )
          v23 = *((_DWORD *)v8 + 9) & 0x60000000 | 0x80000000;
        if( v23 == v39 && (result = v4->OptionalHeader.SectionAlignment, (unsigned int)result <= 0x1000) )
        {
          SectionAlignment = (unsigned int)result;
          v33 = result + v38 - 1i64;
        }
        else
        {
          result = (unsigned __int64)MiGetPteAddress(v21);
          v27 = result;
          if( (MMPTE *)result == v19 )
          {
            v41 = v19;
            v27 = result - 8;
            SectionProtection = v25 | v23 | v24;
          }
          if( v27 >= v26 )
          {
            v28 = MiComputeDriverProtection(SectionProtection_4, v25);
            v31 = v42 - 8;
            if( v29 < v42 )
              v31 = v29;
            result = MiSetSystemCodeProtection(a1, v30, v31, v28);
          }
          SectionAlignment = v4->OptionalHeader.SectionAlignment;
          v33 = SectionAlignment + v38 - 1i64;
          PteAddress = v19;
          v39 = v23;
        }
        v15 = (unsigned __int64)v41;
        v8 = (__int128 *)((char *)v8 + 40);
        v13 = (char *)((-SectionAlignment & (unsigned __int64)&v17[v33]) - 1);
        v44 = v13;
        --v16;
      }
      while( v16 );
    }
  }
  return result;
}

Referenced by: