MiCompleteRestrictedImageFault

NTSTATUS __stdcall MiCompleteRestrictedImageFault(INT64 a1, INT64 a2, INT64 *a3, UINT64 a4){
  unsigned int v4; 
  INT64 *v5; 
  UINT64 v6; 
  _MMPFN *PfnDb; 
  NTSTATUS v9; 
  _MMPFN *v10; 
  unsigned __int64 v11; 
  __int64 bf_0; 
  _CONTROL_AREA *v13; 
  _FILE_OBJECT *v14; 
  _FILE_OBJECT *v15; 
  unsigned int v16; 
  INT64 v17; 
  _MMPFN *v18; 
  unsigned __int64 Long; 
  __int64 v20; 
  _MMPTE *v21; 
  UINT64 v22; 
  unsigned int v23; 
  UINT64 v24; 
  _ETHREAD *CurrentThread; 
  UINT64 v26; 
  _PFSN_TRACE_HEADER *v27; 
  _PFSN_TRACE_HEADER *v28; 
  int v29; 
  int v30; 
  _FILE_OBJECT *v31; 
  __int64 v32; 
  wchar_t *v33; 
  _UNICODE_STRING *v34; 
  unsigned __int64 v35; 
  int v36; 
  __int16 v37; 
  int v38; 
  __int16 v39; 
  __int16 v40; 
  UINT8 v41; 
  int v42; 
  char v43; 
  char v44; 
  NTSTATUS Wsle; 
  _MMPFN *v46; 
  __int64 v47; 
  _MMPFN *v48; 
  VOID *v49; 
  UINT64 Flags; 
  _MI_FAULT_VA_LIST *VirtualFaultInfo; 
  _FILE_OBJECT *FileObject; 
  INT64 *v54; 
  INT64 v55; 
  unsigned __int64 v56; 
  _MMSUPPORT_INSTANCE *Vm; 
  _CONTROL_AREA *ControlArea; 
  UINT64 SpinCount; 
  UINT64 v60; 
  INT64 *v61; 
  unsigned int v62; 

  v62 = a4;
  v61 = a3;
  v60 = a2;
  v4 = a4;
  Vm = *(_MMSUPPORT_INSTANCE **)a1;
  v5 = a3;
  v6 = a2;
  PfnDb = MmGetPfnDb();
  v9 = 1;
  v10 = &PfnDb[*a3];
  v11 = v10->PteLong | 0x8000000000000000ui64;
  bf_0 = v10->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
  v56 = v11;
  if( *(&stru_140C4DB30 + 42) && (bf_0 & 0x10) == 0 )
    bf_0 &= ~*(&stru_140C4DB30 + 42);
  v13 = *(_CONTROL_AREA **)(bf_0 >> 16);
  ControlArea = v13;
  if( PfSnNumActiveTraces )
  {
    v14 = MiReferenceControlAreaFile(v13);
    v11 = v56;
    v15 = v14;
    PfnDb = MmGetPfnDb();
  }
  else
  {
    v15 = 0i64;
  }
  FileObject = v15;
  v16 = 0;
  if( v4 )
  {
    v54 = v5;
    while( 1 )
    {
      v17 = *v5;
      v55 = *v5;
      v18 = &PfnDb[*v5];
      Long = v18->OriginalPte.u.Long;
      v20 = Long;
      if( *(&stru_140C4DB30 + 42) && (Long & 0x10) == 0 )
        v20 = Long & ~*(&stru_140C4DB30 + 42);
      v21 = (_MMPTE *)(v18->PteLong | 0x8000000000000000ui64);
      v22 = v6 + 8 * ((__int64)((__int64)v21 - v11) >> 3);
      if( !v15 )
        goto LABEL_19;
      MiGetSessionIdForVa((VOID *)((__int64)((v22 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16), v11);
      LODWORD(v24) = MiStartingOffset((_SUBSECTION *)(v20 >> 16), v21, v23);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      v26 = v24;
      v27 = PfSnReferenceProcessTrace(CurrentThread->Tcb.ApcState.Process);
      v28 = v27;
      if( !v27 )
        break;
      v29 = PfSnCheckLoggingForThread(CurrentThread, v27, 1ui64);
      v31 = FileObject;
      if( v29 )
      {
        LODWORD(Flags) = v30;
        PfSnLogPageFaultCommon(v28, FileObject, (UINT64)FileObject->FsContext, v26, Flags);
      }
      ExReleaseRundownProtection((_EX_RUNDOWN_REF *)v28 + 45);
      v17 = v55;
      v5 = v54;
LABEL_20:
      LODWORD(v32) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v22, v17, (Long >> 5) & 0x1F);
      v34 = (_UNICODE_STRING *)*(unsigned __int8 *)(a1 + 13);
      v35 = v32 & 0xFFFFFFFFFFFFFFDFui64;
      if( ((unsigned __int8)v34 & 5) != 4 || ((unsigned __int8)v34 & 2) != 0 )
      {
        v9 = 1;
        goto LABEL_35;
      }
      v36 = *(unsigned __int16 *)(a1 + 10);
      v37 = 511;
      if( (_WORD)v36 )
      {
        if( v36 + *(unsigned __int16 *)(a1 + 8) == (((unsigned int)v22 >> 3) & 0x1FF) )
        {
          LOBYTE(v34) = (unsigned __int8)v34 & 0x10;
          LOBYTE(v38) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v18, v34, 0xFFu, v33);
          if( v38 )
          {
            if( !(_BYTE)v34 )
              goto LABEL_29;
          }
          else if( (_BYTE)v34 )
          {
            goto LABEL_29;
          }
        }
        MiEmptyDeferredWorkingSetEntries(a1);
        v37 = 511;
      }
LABEL_29:
      v39 = *(_WORD *)(a1 + 10);
      v9 = 1;
      if( v39 )
      {
        *(_WORD *)(a1 + 10) = v39 + 1;
      }
      else
      {
        *(_WORD *)(a1 + 10) = 1;
        v40 = v37 & ((unsigned int)v22 >> 3);
        v41 = *(_BYTE *)(a1 + 13);
        *(_WORD *)(a1 + 8) = v40;
        LOBYTE(v42) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v18, v34, v41, v33);
        v44 = v43 & 0xEF;
        if( !v42 )
          v44 = v43 | 0x10;
        *(_BYTE *)(a1 + 13) = v44;
      }
LABEL_35:
      LODWORD(VirtualFaultInfo) = 12;
      Wsle = MiAllocateWsle(Vm, (_MMPTE *)v22, v18, 0i64, (_MMPTE)v35, VirtualFaultInfo);
      v4 = v62;
      v6 = v60;
      if( !Wsle )
      {
        v5 = v61;
        v9 = 0;
        goto LABEL_40;
      }
      v11 = v56;
      ++v5;
      ++v16;
      v54 = v5;
      PfnDb = MmGetPfnDb();
      if( v16 >= v62 )
      {
        v5 = v61;
        goto LABEL_40;
      }
      v15 = FileObject;
    }
    v17 = v55;
    v5 = v54;
LABEL_19:
    v31 = FileObject;
    goto LABEL_20;
  }
  v31 = v15;
LABEL_40:
  if( v16 )
  {
    if( *(_WORD *)(a1 + 10) )
      MiEmptyDeferredWorkingSetEntries(a1);
    LODWORD(v47) = MiGetContainingPageTable(v6);
    v46 = MmGetPfnDb();
    v48 = &v46[v47];
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)&v48->u2, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( v48->u2._bf_0 < 0 );
    }
    v48->u2._bf_0 ^= (v48->u2._bf_0 ^ (v48->u2._bf_0 + v16)) & 0x3FFFFFFFFFFFFFFFi64;
    _InterlockedAnd64(&v48->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    LODWORD(v49) = MiGetUsedPtesHandle((PSLIST_ENTRY)((__int64)((v6 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16));
    MiIncreaseUsedPtesCount(v49, (VOID *)v16);
  }
  else
  {
    *(_WORD *)(a1 + 10) = 0;
    v46 = MmGetPfnDb();
  }
  for( ; v16 != v4; ++v16 )
    MiLockAndDecrementShareCount(&v46[v5[v16]], 0i64);
  if( v31 )
    MiDereferenceControlAreaFile(ControlArea, v31);
  return v9;
}

Referenced by: