MiSessionCreateInternal

NTSTATUS __stdcall MiSessionCreateInternal(UINT64 *SessionId){
  _ETHREAD *CurrentThread; 
  _EPROCESS *v3; 
  UINT8 *v4; 
  unsigned int ClearBitsAndSet; 
  unsigned int v6; 
  _RTL_BITMAP *Pool; 
  _RTL_AVL_TABLE *v8; 
  UINT8 *v9; 
  _MMPTE *v10; 
  _MMPTE *v11; 
  __int64 v12; 
  unsigned __int16 v13; 
  int v14; 
  unsigned __int16 v15; 
  __int64 v16; 
  UINT64 v17; 
  UINT64 v18; 
  INT64 v19; 
  unsigned __int64 v20; 
  _EJOB *CurrentServerSilo; 
  _KTBFLUSH_TYPE v23; 
  VOID *v24; 
  VOID *v25; 
  _TABLE_SEARCH_RESULT v26; 
  _TABLE_SEARCH_RESULT v27; 
  INT64 v28; 
  UINT64 v29; 
  _EPROCESS *Process; 
  UINT64 QpcTimeStamp; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v29 = qword_140C4DB20;
  v3 = CurrentThread->Tcb.ApcState.Process;
  --CurrentThread->Tcb.SpecialApcDisable;
  Process = v3;
  ExAcquirePushLockExclusiveEx(&stru_140C4DAF8, 0i64);
  ClearBitsAndSet = (unsigned int)RtlFindClearBitsAndSet(*(&stru_140C4DB30 + 548), (VOID *)1, 0i64, v4, v24, v26);
  if( ClearBitsAndSet == -1 )
  {
    v6 = **(&stru_140C4DB30 + 548) + 128;
    if( v6 > 0x7FFFF )
      v6 = 0x7FFFF;
    Pool = (_RTL_BITMAP *)MiAllocatePool(256i64, 8 * ((v6 >> 6) + ((v6 & 0x3F) != 0) + 2), 0x20206D4Dui64);
    v8 = (_RTL_AVL_TABLE *)Pool;
    if( !Pool )
      goto LABEL_19;
    Pool->SizeOfBitMap = v6;
    Pool->Buffer = &Pool[1].SizeOfBitMap;
    RtlClearAllBits(Pool);
    memmove(
      v8->BalancedRoot.LeftChild,
      *(const VOID **)(*(&stru_140C4DB30 + 548) + 8i64),
      8 * ((**(&stru_140C4DB30 + 548) >> 6) + ((**(&stru_140C4DB30 + 548) & 0x3F) != 0)));
    ExFreePoolWithTag(*(&stru_140C4DB30 + 548), 0);
    *(&stru_140C4DB30 + 548) = v8;
    ClearBitsAndSet = (unsigned int)RtlFindClearBitsAndSet(v8, (VOID *)1, 0i64, v9, v25, v27);
  }
  if( (_InterlockedExchangeAdd64(&stru_140C4DAF8._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&stru_140C4DAF8);
  KeAbPostRelease(&stru_140C4DAF8);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( MiChargeCommit((_MI_PARTITION *)SessionId, 8ui64, 0i64) )
  {
    v10 = MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), 1ui64);
    v11 = v10;
    if( v10 )
    {
      v12 = (__int64)(((_QWORD)v10 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
      if( MiChargeResident((ULONG_PTR *)SessionId, ClearBitsAndSet != 0 ? 1032i64 : 28i64, 0i64) )
      {
        v13 = MiMapNewSession((_MM_SESSION_SPACE *)v12);
        v14 = PsDefaultSystemLocaleId;
        v15 = v13;
        *(_DWORD *)(v12 + 4) = 0;
        *(_DWORD *)(v12 + 96) = v14;
        *(_DWORD *)v12 = 1;
        *(_DWORD *)(v12 + 8) = ClearBitsAndSet;
        LODWORD(v16) = KeQueryInterruptTimePrecise(&QpcTimeStamp);
        v17 = v29;
        v18 = v29;
        *(_QWORD *)(v12 + 1056) = v16;
        LODWORD(v19) = MI_READ_PTE_LOCK_FREE((INT64)&MmGetPml4eBase()[(v18 >> 39) & 0x1FF]);
        v28 = v19;
        LODWORD(v20) = MI_READ_PTE_LOCK_FREE((INT64)&v28);
        *(_QWORD *)(v12 + 32) = (v20 >> 12) & 0xFFFFFFFFFi64;
        *(_WORD *)(v12 + 430) = *(_WORD *)SessionId;
        if( _InterlockedIncrement64((volatile signed __int64 *)(SessionId[22] + 24)) <= 1 )
          __fastfail(0xEu);
        *(_QWORD *)(v12 + 368) = ClearBitsAndSet != 0 ? 1024i64 : 20i64;
        *(_DWORD *)(v12 + 256) = v15;
        *(_QWORD *)(v12 + 40) = 8i64;
        *(_QWORD *)(v12 + 48) = 8i64;
        *(_QWORD *)(v12 + 816) = v28;
        *(_QWORD *)(v12 + 24) = v12 + 16;
        *(_QWORD *)(v12 + 16) = v12 + 16;
        *(_QWORD *)(v12 + 824) = 0i64;
        *(_QWORD *)(v12 + 88) = 0i64;
        *(_QWORD *)(v12 + 856) = 0i64;
        *(_DWORD *)(v12 + 12) = 1;
        *(_QWORD *)(v12 + 224) = _InterlockedIncrement64(&PsNextSecurityDomain);
        CurrentServerSilo = PsGetCurrentServerSilo();
        *(_QWORD *)(v12 + 1048) = CurrentServerSilo;
        if( CurrentServerSilo )
        {
          ObfReferenceObjectWithTag(CurrentServerSilo, 0x73536D4Dui64);
          _InterlockedCompareExchange(
            (volatile signed __int32 *)PsGetServerSiloGlobals(*(_EJOB **)(v12 + 1048))->UserSharedData,
            ClearBitsAndSet,
            -1);
        }
        MiMarkSessionMasterProcess(Process, (_MM_SESSION_SPACE *)v12);
        *(_DWORD *)(v12 + 904) = 4;
        *(_QWORD *)(v12 + 896) = MiGetPteAddress((VOID *)qword_140C4CAE0);
        *(_QWORD *)(v12 + 912) = v17 + 220;
        *(_DWORD *)(v12 + 908) = 1;
        *(_QWORD *)(v12 + 928) = v12 + 856;
        *(_BYTE *)(v12 + 440) = *(_BYTE *)(v12 + 440) & 0xF8 | 1;
        return 0;
      }
    }
    MiReturnCommit((_MI_PARTITION *)SessionId, 8ui64);
    if( v11 )
      MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), v11, 1ui64, v23);
  }
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockExclusiveEx(&stru_140C4DAF8, 0i64);
  _bittestandreset(*(signed __int32 **)(*(&stru_140C4DB30 + 548) + 8i64), ClearBitsAndSet);
LABEL_19:
  if( (_InterlockedExchangeAdd64(&stru_140C4DAF8._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&stru_140C4DAF8);
  KeAbPostRelease(&stru_140C4DAF8);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return -1073741801;
}

Referenced by: