MiMapViewOfImageSection
NTSTATUS __stdcall MiMapViewOfImageSection(
_CONTROL_AREA *ControlArea,
_EPROCESS *RequestingProcess,
_EPROCESS *Process,
VOID **CapturedBase,
_LARGE_INTEGER *SectionOffset,
UINT64 *CapturedViewSize,
_SECTION *Section,
_SECTION_INHERIT InheritDisposition,
UINT64 ProtectionMask,
UINT64 ZeroBits,
UINT64 AllocationType,
UINT64 ImageMapFlags,
UINT64 PreferredNode){
_CONTROL_AREA *v14;
_SEGMENT *Segment;
unsigned __int64 v16;
unsigned int v17;
__int64 ImageInformation;
int DirectoryTableBase;
NTSTATUS result;
int v21;
unsigned int v22;
_CONTROL_AREA *v23;
UINT64 Flink;
_MMVAD *Pool;
_MMVAD *v26;
unsigned int v27;
int v28;
int v29;
union {unsigned int LongFlags;_MMVAD_FLAGS VadFlags;_MM_PRIVATE_VAD_FLAGS PrivateVadFlags;_MM_GRAPHICS_VAD_FLAGS GraphicsVadFlags;_MM_SHARED_VAD_FLAGS SharedVadFlags;volatile unsigned int VolatileVadLong;} v30;
unsigned int v31;
int LongFlags;
_FILE_OBJECT *v33;
union {unsigned int LongFlags2;volatile _MMVAD_FLAGS2 VadFlags2;} v34;
_ETHREAD *CurrentThread;
VOID *v36;
UINT64 v37;
int v38;
int v39;
UINT64 v40;
unsigned __int64 v41;
unsigned __int64 v42;
_SUBSECTION *v43;
unsigned __int64 v44;
unsigned __int64 PtesInSubsection;
int v46;
_RTL_BALANCED_NODE *v47;
int inserted;
NTSTATUS v49;
unsigned int v50;
_FILE_OBJECT *v51;
void *v52;
unsigned __int16 v53;
int v54;
unsigned int v55;
_CONTROL_AREA *v56;
_SEGMENT *v57;
ULONG v58;
int v59;
INT64 v60;
_MMVAD_SHORT *p_Core;
_ETHREAD *v62;
_MMVAD *FixupVad;
UINT64 v64;
UINT64 v65;
UINT64 v66;
unsigned int v67;
__int64 v68;
__int16 v69;
__int64 v70;
__int16 v71;
unsigned __int64 v72;
__int64 v73;
unsigned __int16 Short0;
VOID *v75;
unsigned int SessionId;
INT64 v77;
INT64 v78;
int v79;
int LargePageVad;
_ADAPTER_OBJECT *FileObject;
unsigned __int64 v82;
_ADAPTER_OBJECT *v83;
unsigned int v84;
_ADAPTER_OBJECT *v85;
int v86;
UINT64 v87;
bool v88;
__int64 ********VadEvent;
unsigned __int64 v90;
char v91;
__int64 LongFlags1;
unsigned __int64 v93;
__int64 v94;
unsigned __int64 v95;
INT64 DeepFreezeStartTime_high;
_QWORD *v97;
UINT64 v98;
INT64 InternalFlags;
UINT64 InternalFlagsa;
UINT64 *HINTHonored;
PVOID *StartingAddress;
_ETHREAD *Thread;
_ETHREAD *Threada;
UINT64 v105;
_SEGMENT *v106;
unsigned __int64 a2;
void *a2a;
UINT64 StartingVpn;
UINT64 StartingVpna;
_SUBSECTION *Subsection;
unsigned __int64 v112;
INT64 a6;
__int64 v114;
_IMAGE_INFO_EX ExtendedInfo;
__int64 v116;
__int64 v117[11];
unsigned __int64 Alignment;
NTSTATUS Alignmenta;
v14 = ControlArea;
memset(v117, 0i64, 0x48u);
Segment = v14->Segment;
v16 = RequestingProcess->Pcb.Affinity.Bitmap[0];
v116 = 0i64;
v17 = 0;
v106 = Segment;
memset(&ExtendedInfo, 0, sizeof(ExtendedInfo));
ImageInformation = (__int64)Segment->u2.ImageInformation;
v114 = ImageInformation;
if( dword_140C4C9D0
&& dword_140C4C9D4 == *(_DWORD *)(ImageInformation + 60)
&& dword_140C4C9D8 == Segment->u2.ImageInformation->InternalImageInformation.SizeOfImage )
{
__debugbreak();
}
Thread = (_ETHREAD *)Segment->u1.ImageCommitment;
StartingVpn = (UINT64)Segment->ExtendInfo;
if( ((v14->u.LongFlags & 0x10000000) != 0 || (*(_DWORD *)(v16 + 2172) & 0x2000) != 0)
&& (Segment->SegmentFlags.UChar2 & 1) == 0 )
{
v17 = 1025;
}
DirectoryTableBase = RequestingProcess->Pcb.DirectoryTableBase;
v105 = *(_QWORD *)&RequestingProcess->Pcb.gap0[16];
if( (DirectoryTableBase & 0x20000000) != 0 )
{
if( Segment->ExtendInfo < (_MMEXTEND_INFO *)0x100000000i64 || v17 >= 0x400 )
return -1073741800;
if( (*(_BYTE *)(ImageInformation + 44) & 1) != 0 )
return -1073741207;
v105 = 0x200000i64;
}
if( !SectionOffset || (SectionOffset[7].anonymous_0.LowPart & 0x80000) != 0 || (DirectoryTableBase & 0x40000) != 0 )
{
if( (_DWORD)Section != 1 )
return -1073741755;
v17 |= 0x200u;
}
if( (v17 & 0x200) == 0 )
{
result = MiAllowImageMap((_EPROCESS *)v16, (_SECTION *)SectionOffset);
if( result < 0 )
return result;
v21 = *(_DWORD *)(v16 + 2512);
if( (v21 & 0x10) != 0 && (*(_BYTE *)(ImageInformation + 51) & 4) == 0 )
{
if( (*(_BYTE *)(ImageInformation + 44) & 1) == 0 )
{
v17 |= 1u;
goto LABEL_12;
}
if( (v21 & 8) != 0 )
return -1073741207;
}
}
LABEL_12:
v22 = v17 | 2;
if( (Segment->SegmentFlags.UChar2 & 1) != 0 && (*(_DWORD *)(v16 + 2512) & 0x40) == 0 )
{
v22 |= 1u;
if( v22 < 0x400 )
v22 &= ~2u;
}
v112 = 0i64;
if( (v22 & 0x200) != 0 )
goto LABEL_17;
v23 = v14 + 1;
if( v14 == (_CONTROL_AREA *)-128i64 )
goto LABEL_17;
while( (v23->NumberOfPfnReferences & 0xE) < 0xC )
{
v23 = *(_CONTROL_AREA **)&v23->gap8[8];
if( !v23 )
goto LABEL_17;
}
result = MiArbitraryCodeBlocked((_EPROCESS *)RequestingProcess->Pcb.Affinity.Bitmap[1]);
if( result >= 0 )
{
LABEL_17:
Subsection = (_SUBSECTION *)&v14[1];
MiCheckPurgeAndUpMapCount(v14);
Flink = (UINT64)RequestingProcess->Pcb.ProfileListHead.Flink;
Alignment = Flink;
Pool = (_MMVAD *)MiAllocatePool(64i64, 0x88ui64, 0x20646156ui64);
v26 = Pool;
if( !Pool )
{
MiDereferenceControlArea(v14);
return -1073741670;
}
v27 = Pool->u2.LongFlags2 & 0xFBFFFFFF;
Pool->Core.NextVad = (_MMVAD_SHORT *)-2i64;
Pool->Core.ExtraCreateInfo = (void *)-2i64;
Pool->Core.VadNode.ParentValue = -2i64;
v28 = 0;
if( (_DWORD)CapturedViewSize == 1 )
v28 = 0x4000000;
v29 = v28 | v27;
v30.LongFlags = (unsigned int)v26->Core.u;
v26->u2.LongFlags2 = v29;
v31 = v30.LongFlags & 0xFFFFFF8F | 0x20;
v26->Core.u.LongFlags = v31;
LongFlags = v31 ^ (v31 ^ (HIDWORD(RequestingProcess->Pcb.ThreadListHead.Flink) << 12)) & 0x3F000;
v26->Core.u.LongFlags = LongFlags;
if( SectionOffset )
{
v33 = MiReferenceFileObjectForMap((_SECTION *)SectionOffset);
v34.LongFlags2 = (unsigned int)v26->u2;
v26->FileObject = v33;
LODWORD(v33) = v34.LongFlags2 & 0xF7FFFFFF | ((unsigned int)SectionOffset[7].anonymous_0.HighPart >> 4) & 0x8000000;
LongFlags = v26->Core.u.LongFlags;
v26->u2.LongFlags2 = (unsigned int)v33;
}
v26->Core.PushLock._bf_0 = 0i64;
if( (v22 & 0x200) != 0 )
{
v67 = v22 | 1;
v22 = v22 & 0xFFFFFFFC | 1;
v26->Core.u.LongFlags = LongFlags & 0xFFFFF07F | 0x80;
if( v67 >= 0x400 )
v22 = v67;
}
else
{
v26->Core.u.LongFlags = LongFlags & 0xFFFFF07F | 0x380;
if( (*(_BYTE *)(v16 + 992) & 1) != 0 )
v26->u2.LongFlags2 |= 0x10000000u;
v26->Core.u1.LongFlags1 ^= (v26->Core.u1.LongFlags1 ^ (unsigned int)Thread) & 0x7FFFFFFF;
v26->Core.CommitChargeHigh = (unsigned __int64)Thread >> 31;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
Threada = CurrentThread;
if( (RequestingProcess->Pcb.DeepFreezeStartTime & 1) == 0 || v105 == 0x200000 )
v36 = (VOID *)(StartingVpn + *(unsigned int *)CapturedBase);
else
v36 = *(VOID **)Process->Pcb.gap0;
a2 = (unsigned __int64)v36;
if( v105 == 0x200000 )
{
Alignment = ((unsigned __int64)&RequestingProcess->Pcb.ProfileListHead.Flink[0x1FFFF].Blink + 7) & 0xFFFFFFFFFFE00000ui64;
v22 = v22 & 0xFFFFFFFC | 1;
v26->Core.u1.LongFlags1 ^= (v26->Core.u1.LongFlags1 ^ (Alignment >> 12)) & 0x7FFFFFFF;
v26->Core.CommitChargeHigh = Alignment >> 43;
v26->u2.LongFlags2 |= 0x1000000u;
LargePageVad = MiCreateLargePageVad((_EPROCESS *)v16, &v26->Core);
if( LargePageVad < 0 )
{
FileObject = (_ADAPTER_OBJECT *)v26->FileObject;
if( FileObject )
HalPutDmaAdapter(FileObject);
MiDereferenceControlArea(v14);
ExFreePoolWithTag(v26, 0);
return LargePageVad;
}
Flink = Alignment;
CurrentThread = Threada;
}
a6 = 0i64;
if( MiUserHotPatchReserveSize
&& *(_WORD *)(v114 + 48) == 0x8664
&& (v22 & 0x200) == 0
&& (v26->u2.LongFlags2 & 0x1000000) == 0
&& Flink < 0x7FFFFFFF
&& (*(_BYTE *)(v16 + 992) & 1) == 0 )
{
if( (Flink >> 12) + ((Flink & 0xFFF) != 0) == v106->TotalNumberOfPtes )
{
v82 = Flink + (unsigned int)MiUserHotPatchReserveSize;
if( v82 < Flink )
{
v83 = (_ADAPTER_OBJECT *)v26->FileObject;
if( v83 )
HalPutDmaAdapter(v83);
MiDereferenceControlArea(v14);
ExFreePoolWithTag(v26, 0);
return -1073741793;
}
Flink += (unsigned int)MiUserHotPatchReserveSize;
Alignment = v82;
}
CurrentThread = Threada;
}
if( (v26->Core.u.LongFlags & 0xF80) == 896
&& *(_QWORD *)(v16 + 1088)
&& (*(_DWORD *)(v16 + 2172) & 0x1000) == 0
&& (PVOID)v16 != PsSecureSystemProcess
&& (PspNotifyEnableMask & 1) != 0 )
{
v22 |= 0x800u;
}
LODWORD(v117[8]) = 32;
LOCK_ADDRESS_SPACE(CurrentThread, (_EPROCESS *)v16);
if( (*(_DWORD *)(v16 + 1124) & 0x20) != 0 )
{
inserted = -1073741558;
goto LABEL_188;
}
v37 = v105;
if( (RequestingProcess->Pcb.DeepFreezeStartTime & 1) != 0 && v105 != 0x200000 )
{
v98 = *(_QWORD *)&RequestingProcess->Pcb.gap0[8];
MiIsVaRangeAvailable((_EPROCESS *)v16, v36, Flink, *(VOID **)RequestingProcess->Pcb.gap0);
if( !v86 )
{
inserted = -1073741800;
goto LABEL_188;
}
LABEL_41:
v39 = 1073741827;
v40 = StartingVpn;
v41 = a2 - *(unsigned int *)CapturedBase;
if( v41 == StartingVpn )
v39 = 0;
v26->Core.StartingVpn = a2 >> 12;
StartingVpna = a2 >> 12;
v26->Core.StartingVpnHigh = a2 >> 12 >> 32;
v42 = (a2 - 1 + Flink) >> 12;
v26->Core.EndingVpn = v42;
v26->Core.EndingVpnHigh = BYTE4(v42);
v43 = Subsection;
v44 = (unsigned __int64)*CapturedBase >> 12;
PtesInSubsection = Subsection->PtesInSubsection;
if( v44 >= PtesInSubsection )
{
do
{
v43 = v43->NextSubsection;
v44 -= PtesInSubsection;
PtesInSubsection = v43->PtesInSubsection;
}
while( v44 >= PtesInSubsection );
Subsection = v43;
}
v26->Subsection = v43;
v46 = v39;
Alignmenta = v39;
v26->FirstPrototypePte = &v43->SubsectionBase[v44];
v26->LastContiguousPte = &v106->PrototypePte[v106->TotalNumberOfPtes - 1];
if( (InheritDisposition & 4) == 0 )
{
Alignmenta = v39;
if( (PVOID)v16 != PsSecureSystemProcess )
{
Alignmenta = v39;
if( v41 != v40 )
{
if( (RequestingProcess->Pcb.DirectoryTableBase & 0x800000) == 0 && (v22 & 0x400) == 0
|| (ControlArea->u.LongFlags & 0x800) != 0
|| (v22 & 2) == 0 )
{
Alignmenta = v39;
if( (v22 & 0x400) != 0 )
{
inserted = -1073741800;
goto LABEL_154;
}
}
else
{
FixupVad = MiAllocateFixupVad(v26);
if( FixupVad )
{
ExFreePoolWithTag(v26, 0);
v26 = FixupVad;
v46 = 1073741878;
Alignmenta = 1073741878;
}
else
{
Alignmenta = v39;
v46 = v39;
if( (v22 & 0x400) != 0 )
{
inserted = -1073741670;
goto LABEL_154;
}
}
}
}
}
}
if( HIDWORD(RequestingProcess->Pcb.ThreadListHead.Flink) )
*(_BYTE *)(*(_QWORD *)(v16 + 1680) + 352i64) = 1;
v47 = (_RTL_BALANCED_NODE *)ControlArea;
if( (ControlArea->u.LongFlags & 0x4000000) != 0 )
{
SessionId = MmGetSessionIdEx((_EPROCESS *)v16);
MiCreatePerSessionProtos(ControlArea, SessionId, v77, v78, v98, InternalFlags);
inserted = v79;
if( v79 < 0 )
goto LABEL_154;
v47 = (_RTL_BALANCED_NODE *)ControlArea;
v22 |= 0x80u;
}
if( (v26->u2.LongFlags2 & 0x10000000) != 0 )
{
LongFlags1 = v26->Core.u1.LongFlags1;
LODWORD(LongFlags1) = LongFlags1 & 0x7FFFFFFF;
v93 = LongFlags1 | ((unsigned __int64)v26->Core.CommitChargeHigh << 31);
LODWORD(v94) = MiUpdatePrivateDemandZeroView(v16, (INT64)v26, 0i64);
v95 = v94 + v93;
v26->Core.u1.LongFlags1 ^= (v26->Core.u1.LongFlags1 ^ v95) & 0x7FFFFFFF;
v26->Core.CommitChargeHigh = v95 >> 31;
v117[1] = (__int64)Threada;
MiInsertVadEvent((__int64)v26, v117, 0);
v47 = (_RTL_BALANCED_NODE *)ControlArea;
v22 |= 0x20u;
}
inserted = MiInsertSharedCommitNode(v47, (_EPROCESS *)v16, 0i64);
if( inserted >= 0 )
{
v22 |= 0x40u;
v49 = MiControlAreaRequiresCharge((INT64)ControlArea);
if( v49 )
{
if( v49 != 2 )
goto LABEL_55;
inserted = MiReferenceActiveSubsection(Subsection, v50, 0x11u);
if( inserted >= 0 )
{
v22 |= 0x100u;
LABEL_55:
inserted = MiInsertVadCharges(&v26->Core, v16);
if( inserted >= 0 )
{
if( v46 == 1073741878 )
++*(_QWORD *)(*(_QWORD *)(v16 + 1680) + 384i64);
MiGetWsAndInsertVad(&v26->Core);
v51 = 0i64;
if( v105 == 0x200000 )
{
MiLockVad(Threada, &v26->Core);
inserted = MiMapUserLargePages(&v26->Core, 0i64);
if( inserted < 0 )
{
UNLOCK_ADDRESS_SPACE_UNORDERED(Threada, (_EPROCESS *)v16);
goto LABEL_236;
}
MiUnlockVad(Threada, &v26->Core);
}
v52 = (void *)((v112 << 16) + a2);
a2a = v52;
*(_QWORD *)Process->Pcb.gap0 = v52;
if( !*(_BYTE *)(v114 + 50)
|| (v53 = *(_WORD *)(v114 + 48), v53 >= KUSER_SHARED_DATA.ImageNumberLow)
&& v53 <= KUSER_SHARED_DATA.ImageNumberHigh
|| (v68 = *(_QWORD *)(v16 + 1408)) != 0 && ((v69 = *(_WORD *)(v68 + 8), v69 == 332) || v69 == 452) )
{
v54 = Alignmenta;
}
else
{
v54 = 1073741838;
Alignmenta = 1073741838;
}
v55 = v22 | 4;
if( (v55 & 0x200) != 0 )
{
LABEL_77:
if( (v55 & 8) == 0 )
{
v62 = Threada;
LABEL_92:
if( (v55 & 4) != 0 )
UNLOCK_ADDRESS_SPACE(v62, (_EPROCESS *)v16);
if( (v55 & 0x200) == 0 && SectionOffset && (*(_BYTE *)(v16 + 992) & 1) == 0 )
LODWORD(RequestingProcess->Pcb.DeepFreezeStartTime) |= 4u;
return Alignmenta;
}
MiLockVad(Threada, &v26->Core);
UNLOCK_ADDRESS_SPACE_UNORDERED(Threada, (_EPROCESS *)v16);
v55 &= ~4u;
if( (v26->u2.LongFlags2 & 0x10000000) != 0 )
{
MiUpdatePrivateDemandZeroView(v16, (INT64)v26, 1i64);
MiRemoveVadEvent((__int64)v26, v117);
v55 &= ~0x20u;
}
if( (v55 & 0x10) == 0 || (inserted = MiCommitVadCfgBits(v26, 0i64, 0i64), inserted >= 0) )
{
if( *(_QWORD *)&RequestingProcess->Pcb.Affinity.Count )
{
DeepFreezeStartTime_high = HIDWORD(RequestingProcess->Pcb.DeepFreezeStartTime);
if( (_DWORD)DeepFreezeStartTime_high != 4
&& (unsigned int)(DeepFreezeStartTime_high - 1) > 1
&& (_DWORD)DeepFreezeStartTime_high != -2147483647 )
{
inserted = -1073741755;
goto LABEL_236;
}
LODWORD(v98) = 0;
inserted = MiSecureVad(
(_MI_PARTITION *)v26,
(INT64)a2a,
(INT64)RequestingProcess->Pcb.ProfileListHead.Flink,
DeepFreezeStartTime_high,
v98,
(INT64)&a6);
if( inserted < 0 )
goto LABEL_236;
**(_QWORD **)&RequestingProcess->Pcb.Affinity.Count = a6 ^ *(&stru_140C4DB30 + 12) ^ v16;
v60 = 0i64;
}
else
{
v60 = a6;
}
if( v55 < 0x800
|| (v60 = (INT64)MiAddSecureEntry(
(_MI_PARTITION *)v26,
StartingVpna << 12,
(v42 << 12) | 0xFFF,
-2147483647,
0)) != 0 )
{
if( (HIDWORD(RequestingProcess->Pcb.ThreadListHead.Blink) & 2) != 0 )
MiSoftFaultMappedView((INT64)v26);
p_Core = &v26->Core;
v62 = Threada;
MiUnlockVad(Threada, p_Core);
if( v55 >= 0x800 )
{
PsCallImageNotifyRoutines(&v51->FileName, (VOID *)v16, &ExtendedInfo, v51);
HalPutDmaAdapter((PADAPTER_OBJECT)v51);
}
if( v60 )
MmUnsecureVirtualMemory((VOID *)(v60 ^ *(&stru_140C4DB30 + 12) ^ v16));
goto LABEL_92;
}
inserted = -1073741670;
}
LABEL_236:
MiReferenceVad(&v26->Core);
if( v51 )
HalPutDmaAdapter((PADAPTER_OBJECT)v51);
MiUnmapVad(v26, 0i64);
v97 = *(_QWORD **)&RequestingProcess->Pcb.Affinity.Count;
if( v97 )
*v97 = 0i64;
return inserted;
}
if( (NtGlobalFlag & 0x40000) == 0
|| (v72 = (unsigned int)(v54 - 1073741827), (unsigned int)v72 <= 0x33)
&& (v73 = 0x8000000000801i64, _bittest64(&v73, v72)) )
{
v56 = ControlArea;
}
else
{
v57 = v106;
if( (Threada->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 & 0x20) != 0
|| (Short0 = v106->SegmentFlags.Short0, (Short0 & 0x2000) != 0)
|| (char)v106->SegmentFlags.gap0 >= 0 )
{
v56 = ControlArea;
goto LABEL_67;
}
v106->SegmentFlags.Short0 = Short0 | 0x2000;
v75 = v52;
v56 = ControlArea;
MiLoadUserSymbols(ControlArea, v75, (_EPROCESS *)v16);
}
v57 = v106;
LABEL_67:
if( v55 >= 0x800 )
{
LOBYTE(ExtendedInfo.ImageInfo.anonymous_0.Properties) = 3;
if( (v26->u2.LongFlags2 & 0x8000000) != 0 )
v58 = ExtendedInfo.ImageInfo.anonymous_0.Properties & 0xFFF80FFF;
else
v58 = ExtendedInfo.ImageInfo.anonymous_0.Properties & 0xFFF80FFF | ((v57->SegmentFlags.UChar2 & 0xF0 | ((v57->SegmentFlags.UChar2 & 0xE) << 7)) << 8);
v59 = 0;
if( Alignmenta == 1073741838 )
v59 = 2048;
ExtendedInfo.ImageInfo.anonymous_0.Properties = v58 & 0xFFFFF7FF | v59;
ExtendedInfo.ImageInfo.ImageBase = a2a;
*(_QWORD *)&ExtendedInfo.ImageInfo.ImageSectionNumber = RequestingProcess->Pcb.ProfileListHead.Flink;
if( RequestingProcess->Pcb.ProfileListHead.Flink != (_LIST_ENTRY *)_InterlockedCompareExchange64(
(volatile signed __int64 *)&v57->SizeOfSegment,
-1i64,
-1i64) )
ExtendedInfo.ImageInfo.anonymous_0.Properties |= 0x80000u;
ExtendedInfo.ImageInfo.ImageSelector = 0;
LODWORD(ExtendedInfo.FileObject) = 0;
v51 = MiReferenceControlAreaFile(v56);
v55 |= 8u;
}
if( MiIsProcessCfgEnabled() )
{
v55 |= 0x18u;
}
else if( (v26->u2.LongFlags2 & 0x10000000) != 0
|| *(_QWORD *)&RequestingProcess->Pcb.Affinity.Count
|| (HIDWORD(RequestingProcess->Pcb.ThreadListHead.Blink) & 2) != 0 )
{
v55 |= 8u;
}
goto LABEL_77;
}
}
}
else
{
inserted = -1073740277;
}
}
LABEL_154:
v14 = ControlArea;
LABEL_188:
if( (v22 & 0x80u) != 0 )
{
v84 = MmGetSessionIdEx((_EPROCESS *)v16);
MiDereferencePerSessionProtos(v14, v84);
}
if( (v22 & 0x100) != 0 )
MiReturnCrossPartitionControlAreaCharges((INT64)v14);
if( (v22 & 0x40) != 0 )
MiRemoveSharedCommitNode(v14, (_EPROCESS *)v16, 0i64);
UNLOCK_ADDRESS_SPACE(Threada, (_EPROCESS *)v16);
if( (v22 & 0x20) != 0 )
MiRemoveVadEvent((__int64)v26, v117);
if( v26 )
{
if( v105 == 0x200000 )
MiReleaseVadEventBlocks(&v26->Core);
v85 = (_ADAPTER_OBJECT *)v26->FileObject;
if( v85 )
HalPutDmaAdapter(v85);
ExFreePoolWithTag(v26, 0);
}
MiDereferenceControlArea(v14);
return inserted;
}
if( Flink > 0x7FFFFFFF0000i64 )
{
inserted = -1073741801;
goto LABEL_188;
}
if( (v22 & 1) == 0 )
{
v98 = *(_QWORD *)&RequestingProcess->Pcb.gap0[8];
MiIsVaRangeAvailable((_EPROCESS *)v16, v36, Flink, *(VOID **)RequestingProcess->Pcb.gap0);
if( v38 )
goto LABEL_41;
}
v64 = *(_QWORD *)&RequestingProcess->Pcb.gap0[8];
v65 = 0i64;
if( StartingVpn < 0x100000000i64 && v64 >= 0x100000000i64 && (v106->SegmentFlags.UChar2 & 1) == 0 )
v64 = 0xFFFFFFFFi64;
if( (v106->SegmentFlags.UChar1 & 0x40) != 0 )
{
v70 = *(_QWORD *)(v16 + 1408);
if( !v70 || (v71 = *(_WORD *)(v70 + 8), v71 != 332) && v71 != 452 )
v65 = 0x100000000i64;
}
if( *(_QWORD *)RequestingProcess->Pcb.gap0 >= v64 )
{
inserted = -1073741801;
}
else
{
LODWORD(StartingAddress) = 0;
LODWORD(HINTHonored) = (v26->Core.u.LongFlags >> 7) & 0x1F;
inserted = MiSelectUserAddress(
LODWORD(RequestingProcess->Pcb.DirectoryTableBase),
*(_QWORD *)RequestingProcess->Pcb.gap0,
v64,
Alignment,
v37,
v65,
HINTHonored,
StartingAddress);
if( inserted >= 0 )
{
Flink = Alignment;
v66 = v105;
LABEL_110:
if( v66 == 0x200000 )
{
if( Flink - (unsigned __int64)RequestingProcess->Pcb.ProfileListHead.Flink >= 0x10000 )
v112 = (unsigned int)ExGenRandom(ExGenRandomDomainUserVisible)
% ((Flink - (unsigned __int64)RequestingProcess->Pcb.ProfileListHead.Flink) >> 16);
VadEvent = MiLocateVadEvent((__int64)v26, 16);
VadEvent[2] = (__int64 *******)(v90 >> 12);
*((_BYTE *)VadEvent + 8) = v91;
}
goto LABEL_41;
}
}
v87 = *(_QWORD *)&RequestingProcess->Pcb.gap0[8];
v88 = v64 == v87;
Flink = Alignment;
if( v88 )
{
v66 = v105;
}
else
{
LODWORD(StartingAddress) = 0;
LODWORD(HINTHonored) = (v26->Core.u.LongFlags >> 7) & 0x1F;
InternalFlagsa = v65;
v66 = v105;
inserted = MiSelectUserAddress(
LODWORD(RequestingProcess->Pcb.DirectoryTableBase),
*(_QWORD *)RequestingProcess->Pcb.gap0,
v87,
Alignment,
v105,
InternalFlagsa,
HINTHonored,
StartingAddress);
}
if( inserted < 0 )
goto LABEL_154;
goto LABEL_110;
}
return result;
}Referenced by:
MiMapImageInSystemProcess
MiMapViewOfSection