MiAllocateChildVads

NTSTATUS __stdcall MiAllocateChildVads(ULONG_PTR ProcessToInitialize, UINT64 *LargePageVads){
  _EPROCESS *v2; 
  _MMVAD_SHORT *p_Core; 
  int v4; 
  _QWORD *Children; 
  _RTL_BALANCED_NODE *i; 
  _QWORD **v8; 
  INT64 v9; 
  _QWORD *v10; 
  _QWORD *v11; 
  int v12; 
  unsigned int v13; 
  unsigned __int64 v14; 
  _MMVAD *Pool; 
  _MMVAD *v16; 
  union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v17; 
  unsigned int v18; 
  int v19; 
  int inserted; 
  __int64 LongFlags1; 
  int v22; 
  unsigned __int64 v23; 
  int v24; 
  int v25; 
  NTSTATUS v26; 
  int v28; 
  int v29; 
  _KAPC_STATE ApcState; 

  v2 = *(_EPROCESS **)&ProcessToInitialize;
  memset(&ApcState, 0, sizeof(ApcState));
  p_Core = 0i64;
  v4 = 0;
  Children = 0i64;
  for( i = KeGetCurrentThread()->ApcState.Process->VadRoot.Root; i; i = i->Children[0] )
    Children = i->Children;
  while( 1 )
  {
    do
    {
      if( !Children )
        return MiInsertChildVads((ULONG_PTR)v2, p_Core);
      v8 = (_QWORD **)Children[1];
      v9 = (INT64)Children;
      v10 = Children;
      if( v8 )
      {
        v11 = *v8;
        for( Children = (_QWORD *)Children[1]; v11; v11 = (_QWORD *)*v11 )
          Children = v11;
      }
      else
      {
        while( 1 )
        {
          Children = (_QWORD *)(Children[2] & 0xFFFFFFFFFFFFFFFCui64);
          if( !Children || (_QWORD *)*Children == v10 )
            break;
          v10 = Children;
        }
      }
    }
    while( !MiVadShouldBeForked(v9) );
    v12 = *(_DWORD *)(v9 + 48);
    v13 = 1818517846;
    v14 = (-(__int64)((v12 & 0x100000) != 0) & 0xFFFFFFFFFFFFFFB8ui64) + 136;
    if( (v12 & 0x100000) == 0 && (v12 & 0x70) == 32 && (v12 & 0x200000) != 0 )
    {
      v13 = 1231315286;
      v14 = 8
          * (((unsigned __int64)*(unsigned int *)(***(_QWORD ***)(v9 + 72) + 8i64) >> 6)
           + ((*(_DWORD *)(***(_QWORD ***)(v9 + 72) + 8i64) & 0x3F) != 0)
           + 20i64);
    }
    Pool = (_MMVAD *)MiAllocatePool(64i64, v14, v13);
    v16 = Pool;
    if( !Pool )
      break;
    memmove(Pool, (const VOID *)v9, v14);
    v17.LongFlags = (unsigned int)v16->Core.u;
    if( (*(_DWORD *)(v9 + 48) & 0x100000) != 0 )
      v17.LongFlags &= ~8u;
    else
      v16->VadsProcess = (_EPROCESS *)((unsigned __int64)v2 | 1);
    v16->Core.EventList = 0i64;
    v18 = v17.LongFlags & 0xFFFFFFFC;
    v16->Core.ReferenceCount = 0;
    v16->Core.PushLock._bf_0 = 0i64;
    v16->Core.ExtraCreateInfo = 0i64;
    v16->Core.u.LongFlags = v18;
    if( (v18 & 0x100000) == 0 && (v18 & 0x70) == 32 && (v18 & 0x400000) != 0 )
      v16->Core.u.LongFlags = v18 & 0xFFBFFFFF;
    v16->Core.VadNode.ParentValue = -2i64;
    LOBYTE(v19) = MiVadHasSharedCommit(v9);
    if( v19 )
    {
      inserted = MiInsertSharedCommitNode(**(_RTL_BALANCED_NODE ***)(v9 + 72), v2, 0i64);
      if( inserted < 0 )
        goto LABEL_52;
    }
    if( MiVadPureReserve(&v16->Core) )
    {
      LongFlags1 = v16->Core.u1.LongFlags1;
      LODWORD(LongFlags1) = LongFlags1 & 0x7FFFFFFF;
      if( (LongFlags1 | ((unsigned __int64)v16->Core.CommitChargeHigh << 31)) < 0x7FFFFFFFDi64 )
      {
        inserted = MiCloneCaptureVadCommit((INT64)v16);
        if( inserted < 0 )
        {
          LOBYTE(v28) = MiVadHasSharedCommit((INT64)v16);
          if( v28 )
            MiRemoveSharedCommitNode(v16->Subsection->ControlArea, v2, 0i64);
LABEL_52:
          ExFreePoolWithTag(v16, 0);
          v16 = 0i64;
          goto LABEL_56;
        }
      }
    }
    if( (*(_DWORD *)(v9 + 48) & 8) != 0 )
    {
      inserted = MiCloneNoChange((_MMVAD_SHORT *)v9, &v16->Core);
      if( inserted < 0 )
        goto LABEL_56;
    }
    if( MiLocateVadEvent(v9, 128) )
    {
      KiStackAttachProcess(v2, 0i64, &ApcState);
      v4 = 1;
      inserted = MiCreatePlaceholderStorage(&v16->Core);
      if( inserted < 0 )
        goto LABEL_56;
    }
    if( (*(_DWORD *)(v9 + 48) & 0x300000) == 3145728 )
    {
      if( !v4 )
      {
        KiStackAttachProcess(v2, 0i64, &ApcState);
        v4 = 1;
      }
      inserted = MiCreateWriteWatchView(
                   v2,
                   &v16->Core,
                   (v16->Core.EndingVpn | ((unsigned __int64)v16->Core.EndingVpnHigh << 32))
                 - (v16->Core.StartingVpn | ((unsigned __int64)v16->Core.StartingVpnHigh << 32))
                 + 1);
      if( inserted < 0 )
        goto LABEL_56;
    }
    LOBYTE(v22) = MiIsVadLargePrivate(v9);
    if( v22 )
    {
      v23 = *(_DWORD *)(v9 + 52) & 0x7FFFFFFF | ((unsigned __int64)*(unsigned __int8 *)(v9 + 34) << 31);
      v24 = (v23 ^ v16->Core.u1.LongFlags1) & 0x7FFFFFFF;
      v16->Core.CommitChargeHigh = v23 >> 31;
      v16->Core.u1.LongFlags1 ^= v24;
      inserted = MiCreateLargePageVad(v2, &v16->Core);
      if( inserted < 0 )
        goto LABEL_56;
      ++*LargePageVads;
    }
    else
    {
      v25 = *(_DWORD *)(v9 + 48) & 0x70;
      if( v25 == 32 )
      {
        v26 = MiCloneImageVad(v2, v16, (_MMVAD *)v9);
      }
      else
      {
        if( v25 != 80 || !*(_QWORD *)(**(_QWORD **)(v9 + 72) + 64i64) )
          goto LABEL_47;
        v26 = MiCloneLargeFileOnlyVad((_MMVAD *)v9);
      }
      inserted = v26;
      if( v26 < 0 )
        goto LABEL_56;
    }
LABEL_47:
    if( v4 )
    {
      KiUnstackDetachProcess(&ApcState, 0i64);
      v4 = 0;
    }
    v16->Core.NextVad = p_Core;
    p_Core = &v16->Core;
  }
  inserted = -1073741670;
LABEL_56:
  if( !v4 )
    KiStackAttachProcess(v2, 0i64, &ApcState);
  if( v16 )
  {
    LOBYTE(v29) = MiVadHasSharedCommit((INT64)v16);
    if( v29 )
      MiRemoveSharedCommitNode(v16->Subsection->ControlArea, v2, 0i64);
    MiCloneDiscardVadCommit((INT64)v16);
    MiFreeVadEventBitmap((ULONG_PTR)v2, &v16->Core, 4ui64);
    MiFreePlaceholderStorage((INT64)v16);
    MiFreeVadEvents(&v16->Core);
    ExFreePoolWithTag(v16, 0);
  }
  if( p_Core )
    MiDeletePartialCloneVads(p_Core);
  KiUnstackDetachProcess(&ApcState, 0i64);
  return inserted;
}

Referenced by: