MiQueryLoadedPatches

INT64 __stdcall MiQueryLoadedPatches(PSID SourceSid, INT64 a2){
  _DWORD *v2; 
  __int64 v3; 
  _ETHREAD *CurrentThread; 
  RTL_BALANCED_NODE **v5; 
  unsigned __int64 j; 
  __int64 v7; 
  _DWORD *v8; 
  _QWORD *v9; 
  _QWORD *UserSidHotPatchContext; 
  unsigned __int64 v12; 
  unsigned int v13; 
  RTL_BALANCED_NODE *v14; 
  unsigned __int64 i; 
  unsigned __int64 v16; 
  _QWORD **v17; 
  _QWORD *v18; 
  unsigned int v19; 
  int v20; 
  _DWORD *v21; 
  UNICODE_STRING *v22; 
  _DWORD *v23; 
  __int64 v24; 
  UNICODE_STRING *v25; 
  char *v26; 
  char *v27; 
  wchar_t *v28; 
  unsigned __int16 v29; 
  unsigned __int64 v30; 
  _QWORD **v31; 
  _QWORD *v32; 
  _ETHREAD *v34; 
  _DWORD *v36; 
  unsigned int v37; 
  v36 = v2;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = 0i64;
  j = 0i64;
  v34 = CurrentThread;
  v7 = v3;
  v8 = v2;
  v9 = (_QWORD *)a2;
  --*((_WORD *)CurrentThread + 243);
  ExAcquirePushLockSharedEx((UINT64)&MiHotPatchListLock, 0i64);
  if( SourceSid )
  {
    UserSidHotPatchContext = MiFindUserSidHotPatchContext((UINT8 *)SourceSid);
    if( UserSidHotPatchContext )
      v5 = (RTL_BALANCED_NODE **)(UserSidHotPatchContext + 3);
  }
  else
  {
    v5 = &MiGlobalHotPatchList;
  }
  v12 = 96i64;
  v13 = 0;
  if( v5 )
  {
    v14 = *v5;
    j = 0i64;
    while( v14 )
    {
      j = (unsigned __int64)v14;
      v14 = v14->Children[0];
    }
    i = j;
    while( i )
    {
      ++v13;
      v16 = i;
      v12 += *(unsigned __int16 *)(i + 32) + 24i64;
      v17 = *(_QWORD ***)(i + 8);
      if( v17 )
      {
        v18 = *v17;
        for( i = *(_QWORD *)(i + 8); v18; v18 = (_QWORD *)*v18 )
          i = (unsigned __int64)v18;
      }
      else
      {
        while( 1 )
        {
          i = *(_QWORD *)(i + 16) & 0xFFFFFFFFFFFFFFFCui64;
          if( !i || *(_QWORD *)i == v16 )
            break;
          v16 = i;
        }
      }
    }
  }
  if( v37 >= v12 )
  {
    v20 = v12;
    LODWORD(v21) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
    v23 = v21;
    if( !v21 )
    {
      v19 = -1073741670;
      goto LABEL_40;
    }
    *v21 = 2;
    if( SourceSid )
      RtlCopySid(0x44u, v21 + 1, SourceSid);
    if( v13 )
    {
      v24 = v13;
      v25 = (UNICODE_STRING *)(v23 + 24);
      *((_QWORD *)v23 + 10) = v23 + 24;
      v26 = (char *)v23 - v7;
      v27 = (char *)&v23[4 * v24 + 24];
      *((_QWORD *)v23 + 11) = v27;
      v28 = (wchar_t *)&v27[8 * v24];
      if( j )
      {
        do
        {
          *(_DWORD *)v27 = *(_DWORD *)(j + 24);
          *((_DWORD *)v27 + 1) = *(_DWORD *)(j + 28);
          v29 = *(_WORD *)(j + 32);
          v25->Length = v29;
          v25->MaximumLength = v29;
          v25->Buffer = v28;
          RtlCopyUnicodeString(v25, (UNICODE_STRING *)(j + 32), v22);
          v25->Buffer = (wchar_t *)((char *)v25->Buffer - v26);
          v27 += 8;
          ++v23[18];
          v30 = j;
          v28 = (wchar_t *)((char *)v28 + v25->Length);
          ++v25;
          v31 = *(_QWORD ***)(j + 8);
          if( v31 )
          {
            v32 = *v31;
            for( j = *(_QWORD *)(j + 8); v32; v32 = (_QWORD *)*v32 )
              j = (unsigned __int64)v32;
          }
          else
          {
            while( 1 )
            {
              j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
              if( !j || *(_QWORD *)j == v30 )
                break;
              v30 = j;
            }
          }
        }
        while( j );
        v27 = (char *)*((_QWORD *)v23 + 11);
        v25 = (UNICODE_STRING *)*((_QWORD *)v23 + 10);
      }
      v9 = (_QWORD *)a2;
      *((_QWORD *)v23 + 11) = v27 - v26;
      *((_QWORD *)v23 + 10) = (char *)v25 - v26;
      CurrentThread = v34;
    }
    *v9 = v23;
    *v36 = v20;
  }
  else
  {
    if( v12 > 0xFFFFFFFF )
    {
      v19 = -1073741675;
      goto LABEL_40;
    }
    *v9 = 0i64;
    *v8 = v12;
  }
  v19 = 0;
LABEL_40:
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&MiHotPatchListLock, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)&MiHotPatchListLock);
  KeAbPostRelease(&MiHotPatchListLock);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return v19;
}

Referenced by: