MmChangeSectionBackingFile

VOID __fastcall MmChangeSectionBackingFile(_FILE_OBJECT *CurrentFileObject, _FILE_OBJECT *NewFileObject, UINT64 Flags){
  int v5; 
  unsigned __int8 v6; 
  _SECTION_OBJECT_POINTERS *SectionObjectPointer; 
  unsigned __int64 v8; 
  _EX_FAST_REF *DataSectionObject; 
  UINT64 v10; 
  _EX_FAST_REF *v11; 
  unsigned __int64 v12; 
  _FILE_OBJECT *v13; 
  int Object; 
  INT64 *v15; 

  if( (Flags & 0xFFFFFFFC) != 0
    || (_DWORD)Flags == 3
    || CurrentFileObject && CurrentFileObject->SectionObjectPointer != NewFileObject->SectionObjectPointer )
  {
    return;
  }
  v5 = Flags & 1;
  while( 1 )
  {
    v6 = ExAcquireSpinLockExclusive(&SpinLock);
    SectionObjectPointer = NewFileObject->SectionObjectPointer;
    v8 = v6;
    if( v5 )
      DataSectionObject = (_EX_FAST_REF *)SectionObjectPointer->DataSectionObject;
    else
      DataSectionObject = (_EX_FAST_REF *)SectionObjectPointer->ImageSectionObject;
    if( !DataSectionObject )
    {
      v15 = &SpinLock;
      goto LABEL_18;
    }
    if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel((INT64 *)&DataSectionObject[9]) )
      break;
    ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
    __writecr8(v8);
  }
  ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
  if( ((__int64)DataSectionObject[7].Object & 1) == 0 )
  {
    v11 = DataSectionObject + 8;
    if( !CurrentFileObject )
    {
      v12 = v11->Value & 0xFFFFFFFFFFFFFFF0ui64;
      if( !v12 )
        goto LABEL_14;
      ObFastReplaceObject(v11, NewFileObject, v10);
      ObfReferenceObjectWithTag(NewFileObject, 0x746C6644ui64);
      v13 = (_FILE_OBJECT *)v12;
      goto LABEL_13;
    }
    if( (_FILE_OBJECT *)(v11->Value & 0xFFFFFFFFFFFFFFF0ui64) == CurrentFileObject )
    {
      ObFastReplaceObject(v11, NewFileObject, v10);
      ObfReferenceObjectWithTag(NewFileObject, 0x746C6644ui64);
      v13 = CurrentFileObject;
LABEL_13:
      ObDereferenceObjectDeferDeleteWithTag((UINT64)v13, 1953261124i64);
    }
  }
LABEL_14:
  Object = (int)DataSectionObject[7].Object;
  if( (Object & 0x200) != 0 && ((__int64)KeGetCurrentThread()[1].Queue & 0x40) == 0 )
    LODWORD(DataSectionObject[7].Object) = Object & 0xFFFFFDFF;
  v15 = (INT64 *)&DataSectionObject[9];
LABEL_18:
  ExReleaseSpinLockExclusiveFromDpcLevel(v15);
  __writecr8(v8);
}

Referenced by: