MiAddWorkingSetEntries
NTSTATUS __stdcall MiAddWorkingSetEntries(INT64 a1, UINT64 a2, UINT8 *a3, CHAR a4){
char v4;
unsigned __int64 v7;
unsigned __int64 *v9;
int v10;
UINT8 *v11;
unsigned __int64 v12;
unsigned __int64 v13;
_QWORD *v14;
unsigned __int64 v15;
unsigned __int64 v16;
char v17;
_MMPTE *PteBase;
_MMPTE *PteLimit;
UINT8 *v20;
char v21;
int v22;
unsigned __int8 v23;
UINT64 v24;
_MMPFN *v25;
__int64 bf_0;
unsigned __int8 v27;
UINT64 Next;
UINT64 v29;
UINT64 v30;
INT64 v31;
_MMPFN *v32;
__int64 v33;
unsigned __int64 v34;
__int64 v35;
__int64 v36;
__int64 *v37;
__int64 *v38;
__int64 v39;
__int64 v40;
unsigned __int64 v41;
unsigned __int64 *v42;
unsigned __int64 v43;
unsigned __int8 v44;
int v45;
__int64 v46;
__int64 **v47;
__int64 v48;
_MI_PARTITION *v49;
NTSTATUS StandbyRepurposed;
__int64 v51;
int v52;
_KSPIN_LOCK_QUEUE LockQueue;
__int64 v55;
UINT64 v56;
UINT64 v57;
_KLOCK_QUEUE_HANDLE LockHandle;
__int64 v59;
UINT64 v60;
__int128 v61;
__int64 v62;
_OWORD v63[2];
v4 = *(_BYTE *)(a1 + 184) & 7;
v55 = 0i64;
v60 = a2;
v7 = a2;
if( v4 == 2 )
v9 = (unsigned __int64 *)((char *)&stru_140C4DB30 + 6608);
else
v9 = (unsigned __int64 *)(a1 + 256);
LockQueue.Lock = v9;
LockQueue.Next = 0i64;
if( _InterlockedExchange64((volatile __int64 *)v9, (__int64)&LockQueue) )
KxWaitForLockOwnerShip((INT64)&LockQueue);
v10 = 1;
if( (a4 & 1) != 0 )
{
v11 = &a3[*(_QWORD *)(a1 + 120)];
if( (unsigned __int64)v11 > *(_QWORD *)(a1 + 112) && (*(_BYTE *)(a1 + 187) & 8) == 0 )
{
v12 = *(_QWORD *)(a1 + 136);
v13 = *(_QWORD *)(*(_QWORD *)(a1 + 16) + 32i64);
if( v12 > v13 )
{
v14 = *(_QWORD **)(*(&stru_140C4DB30 + 267) + 8i64 * *(unsigned __int16 *)(a1 + 174));
v15 = v14[866];
if( (v12 & 0x3F) != 0 )
{
v16 = -1i64;
}
else
{
v16 = v14[888];
if( v16 < v15 / 0x14 )
{
v10 = 1;
if( v12 >= v15 / 0x14 )
{
LABEL_71:
*(_BYTE *)(a1 + 187) |= 8u;
goto LABEL_13;
}
}
else
{
v10 = 1;
}
}
if( v12 - v13 >= 3 * (v15 >> 2) )
{
v49 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * *(unsigned __int16 *)(a1 + 174));
v59 = v14[856];
StandbyRepurposed = MiGetStandbyRepurposed(v49, 1ui64);
if( StandbyRepurposed == v52 )
{
v10 = 1;
}
else
{
if( v51 )
v16 = v14[888];
v10 = 1;
if( v16 < 10i64 * *(_QWORD *)(v59 + 2384) )
goto LABEL_71;
}
}
}
if( (*(_BYTE *)(a1 + 184) & 0x40) != 0 && (unsigned __int64)v11 > *(_QWORD *)(a1 + 152) )
goto LABEL_71;
}
}
LABEL_13:
v17 = *(_BYTE *)(a1 + 184);
*(_DWORD *)(a1 + 4) += (_DWORD)a3;
if( (v17 & 7) == 2 )
*(&stru_140C4DB30 + 1668) += (_DWORD)a3;
__addgsdword(0x2E90u, (unsigned int)a3);
*(_QWORD *)(a1 + 136) += a3;
PteBase = MmGetPteBase();
PteLimit = MmGetPteLimit();
if( v7 < (unsigned __int64)PteBase || v7 > (unsigned __int64)PteLimit )
*(_QWORD *)(a1 + 120) += a3;
else
v10 = 0;
v20 = &a3[*(_QWORD *)(a1 + 120)];
if( (unsigned __int64)v20 > *(_QWORD *)(a1 + 160) )
*(_QWORD *)(a1 + 160) = v20;
if( (*(_BYTE *)(a1 + 184) & 7) == 2 )
{
*(&stru_140C4DB30 + 835) += a3;
if( v10 == 1 )
*(&stru_140C4DB30 + 836) += a3;
if( *(&stru_140C4DB30 + 836) > *(&stru_140C4DB30 + 837) )
*(&stru_140C4DB30 + 837) = *(&stru_140C4DB30 + 836);
}
if( (a4 & 2) != 0 )
{
*(_QWORD *)(a1 + 144) += a3;
v61 = 0i64;
v62 = 0i64;
if( v7 < (unsigned __int64)PteBase || v7 > (unsigned __int64)PteLimit )
*(_QWORD *)(a1 + 128) += a3;
}
v21 = *(_BYTE *)(a1 + 184);
if( (v21 & 7u) >= 2 )
{
v39 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * *(unsigned __int16 *)(a1 + 174));
v40 = (v21 & 7u) - 2;
v41 = *(_QWORD *)(a1 + 136) + *(_QWORD *)(v39 + 4352);
if( v41 > *(_QWORD *)(v39 + 8 * v40 + 4360) )
{
*(_QWORD *)(v39 + 8 * v40 + 4360) = v41;
v21 = *(_BYTE *)(a1 + 184);
}
if( (v21 & 7) == 4 )
{
if( PsNtosImageBase
&& (v7 >= PsNtosImageBase && v7 < PsNtosImageEnd || v7 < PsHalImageEnd && v7 >= (unsigned __int64)PsHalImageBase) )
{
LODWORD(xmmword_140C4CA88) = (_DWORD)a3 + xmmword_140C4CA88;
}
else
{
if( MiGetSystemRegionType(v7) == 12 && MiIsDriverPage((__int64)PteBase + ((v7 >> 9) & 0x7FFFFFFFF8i64)) )
DWORD1(xmmword_140C4CA88) += (_DWORD)a3;
PteLimit = MmGetPteLimit();
}
}
}
v22 = a4 & 4;
if( v22 && a3 )
{
while( 1 )
{
if( v7 < (unsigned __int64)PteBase || v7 > (unsigned __int64)PteLimit )
{
v23 = HIBYTE(*(unsigned __int64 *)((char *)&PteBase->u.Long + ((v7 >> 9) & 0x7FFFFFFFF8i64))) & 0xF;
}
else
{
v42 = (unsigned __int64 *)((char *)&PteBase->u.Long + ((v7 >> 9) & 0x7FFFFFFFF8i64));
v43 = *v42;
MiPteInShadowRange((UINT64)v42);
v23 = (MmGetPfnDb()[(v43 >> 12) & 0xFFFFFFFFFi64].$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::gap0[0] >> 1) & 7;
}
if( v7 < (unsigned __int64)PteBase || v7 > (unsigned __int64)MmGetPteLimit() )
{
v24 = *(unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long + ((v7 >> 18) & 0x3FFFFFF8));
v56 = v24;
MiPteInShadowRange((UINT64)&v56);
v25 = &MmGetPfnDb()[(v24 >> 12) & 0xFFFFFFFFFi64];
bf_0 = v25->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
v27 = ((unsigned __int64)v25->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 14) & 7;
if( (((unsigned __int64)v25->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 4) & 0x3FF) != 0 )
{
if( v23 == v27 )
{
v25->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = bf_0 ^ ((unsigned __int16)bf_0 ^ (unsigned __int16)(16 * ((((unsigned __int64)v25->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 4) & 0x3FF) + 1))) & 0x3FF0;
}
else if( v23 > v27 )
{
v25->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = bf_0 & 0xFFFFFFFFFFFE001Fui64 | ((unsigned __int64)(v23 & 7) << 14) | 0x10;
}
}
}
++*(_QWORD *)(a1 + 8i64 * v23 + 40);
if( v23 == 7 )
{
v33 = *(unsigned __int16 *)(a1 + 174);
v34 = *(_QWORD *)(a1 + 96);
memset(&LockHandle, 0, sizeof(LockHandle));
v35 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * v33);
v36 = *(_QWORD *)(v35 + 6848);
if( v34 >= *(_QWORD *)(v36 + 56) )
{
v37 = (__int64 *)(a1 + 24);
if( *(_QWORD *)(a1 + 24) )
{
v38 = (__int64 *)(v35 + 6856);
if( *(__int64 **)(v35 + 6856) != v37 )
{
LockHandle.LockQueue.Lock = (unsigned __int64 *volatile)((char *)&stru_140C4DB30 + 4176);
LockHandle.LockQueue.Next = 0i64;
if( _InterlockedExchange64((_QWORD *)&stru_140C4DB30 + 522, (__int64)&LockHandle) )
KxWaitForLockOwnerShip((INT64)&LockHandle);
if( *(_BYTE *)(v36 + 53) || (v46 = *v37) == 0 )
{
*(_BYTE *)(v36 + 54) = 1;
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
}
else
{
v47 = *(__int64 ***)(a1 + 32);
if( *(__int64 **)(v46 + 8) != v37
|| *v47 != v37
|| (*v47 = (__int64 *)v46, *(_QWORD *)(v46 + 8) = v47, v48 = *v38, *(__int64 **)(*v38 + 8) != v38) )
{
__fastfail(3u);
}
*v37 = v48;
*(_QWORD *)(a1 + 32) = v38;
*(_QWORD *)(v48 + 8) = v37;
*v38 = (__int64)v37;
KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
}
}
}
}
PteBase = MmGetPteBase();
}
v7 += 4096i64;
if( !--a3 )
break;
PteLimit = MmGetPteLimit();
}
}
_m_prefetchw(&LockQueue);
Next = (UINT64)LockQueue.Next;
if( !LockQueue.Next )
{
Next = _InterlockedCompareExchange64((volatile signed __int64 *)LockQueue.Lock, 0i64, (signed __int64)&LockQueue);
if( (_KSPIN_LOCK_QUEUE *)Next == &LockQueue )
goto LABEL_36;
Next = (UINT64)KxWaitForLockChainValid(&LockQueue);
}
LockQueue.Next = 0i64;
_InterlockedXor64((volatile signed __int64 *)(Next + 8), 1ui64);
LABEL_36:
if( v22 )
{
v29 = v60;
if( v60 < (unsigned __int64)PteBase || (Next = (UINT64)MmGetPteLimit(), v60 > Next) )
{
v30 = *(unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long + ((v60 >> 18) & 0x3FFFFFF8));
v57 = v30;
MiPteInShadowRange((UINT64)&v57);
v32 = &MmGetPfnDb()[(v30 >> 12) & 0xFFFFFFFFFi64];
Next = (unsigned __int64)LODWORD(v32->ListEntry.Flink) >> 4;
if( (Next & 0x3FF) == 0 )
{
MiCountWslesInPageTable(v31, v29, v63);
v44 = 8;
while( 1 )
{
LODWORD(Next) = --v44;
v45 = *((_DWORD *)v63 + v44);
if( v45 )
break;
if( !v44 )
return Next;
}
Next = v32->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 & 0xFFFFFFFFFFFE000Fui64;
v32->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = Next | (16 * (v45 & 0x3FF | ((unsigned __int64)(v44 & 7) << 10)));
}
}
}
return Next;
}Referenced by:
MiAllocateWsle
MiEmptyDeferredWorkingSetEntries
MiMakeSystemCacheRangeValid