MiLockStealSystemVm

NTSTATUS __stdcall MiLockStealSystemVm(UINT64 a1, UINT8 a2, INT64 a3, INT64 a4){
  unsigned __int64 v6; 
  _MMPTE *PteBase; 
  _UNICODE_STRING *v8; 
  unsigned __int64 v9; 
  VOID *v10; 
  unsigned int SystemRegionType; 
  _MMPTE *v12; 
  NTSTATUS v13; 
  unsigned int v14; 
  char v15; 
  bool v16; 
  int v17; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  _MMSUPPORT_INSTANCE *v19; 
  __int64 v20; 
  void *v21; 
  INT64 v22; 
  INT64 v23; 
  INT16 v24; 
  _MMSUPPORT_INSTANCE *SessionVm; 
  _MMSUPPORT_INSTANCE *v26; 
  int v27; 
  VOID *v28; 
  unsigned __int64 v29; 
  wchar_t *v30; 
  INT64 v32; 
  unsigned __int64 v33; 
  int v34; 
  INT64 v35; 
  int v36; 
  int v37; 
  int v38; 
  NTSTATUS v39; 
  INT64 v40; 
  INT64 v41; 
  _UNICODE_STRING *antNameB; 

  v41 = a3;
  v6 = a2;
  PteBase = MmGetPteBase();
  v8 = *(_UNICODE_STRING **)(*(&stru_140C4DB30 + 267) + 8 * ((*(_QWORD *)(a1 + 40) >> 39) & 0x3FFi64));
  antNameB = v8;
  v9 = ((a3 << 25) - ((_QWORD)PteBase << 25)) >> 16;
  SystemRegionType = MiGetSystemRegionType(v9);
  v12 = PteBase;
  v13 = 0;
  if( v9 < (unsigned __int64)v12 || (v14 = 1, v9 > (unsigned __int64)MmGetPteLimit()) )
    v14 = 0;
  if( SystemRegionType == 5 )
  {
    v15 = *(_BYTE *)(a1 + 35);
    _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
    v16 = (v15 & 0x10) == 0;
    v17 = KiIrqlFlags;
    if( v16 )
    {
      __writecr8(v6);
      AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeNonPagedPool, v10);
      *(_DWORD *)(a4 + 8) |= 0x20u;
      v19 = AnyMultiplexedVm;
      goto LABEL_19;
    }
    goto LABEL_39;
  }
  if( SystemRegionType != 1 )
  {
    if( SystemRegionType == 6 )
    {
      _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v6);
      v26 = MiGetAnyMultiplexedVm(MiWorkingSetTypePagedPool, v10);
      *(_DWORD *)(a4 + 8) |= 0x10u;
      v19 = v26;
    }
    else if( SystemRegionType == 12 )
    {
      _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v6);
      v19 = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v10);
      *(_DWORD *)(a4 + 48) = v27;
    }
    else
    {
      if( SystemRegionType != 9 || !MiVaIsPageFileHash(v8) )
      {
        _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
        v17 = KiIrqlFlags;
LABEL_39:
        if( v17 && (v17 & 1) != 0 )
          KeGetCurrentIrql();
        __writecr8(v6);
        return 0;
      }
      v19 = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemPtes, v28);
      *(_DWORD *)(a4 + 48) = 2;
      _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v6);
    }
    goto LABEL_19;
  }
  LODWORD(v20) = MiReferenceOwningSession((_XSTATE_CONFIGURATION *)a1);
  *(_QWORD *)(a4 + 56) = v20;
  _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(v6);
  v21 = *(void **)(a4 + 56);
  if( v21 )
  {
    if( MmAttachSession(v21, (_KAPC_STATE *)(a4 + 72)) < 0 )
    {
      *(_QWORD *)(a4 + 56) = 0i64;
      return 0;
    }
    SessionVm = MiGetSessionVm(v23, v22, v24);
    *(_DWORD *)(a4 + 8) |= 0x80u;
    v19 = SessionVm;
LABEL_19:
    if( !MiSynchronizeSystemVa((INT64)v19, v9, SystemRegionType, v14, a4) )
      goto LABEL_23;
    v29 = (__int64)(a1 - (_QWORD)MmGetPfnDb()) / 48;
    if( v14 )
    {
      if( !MiSmallVaStillMapsFrame((VOID *)v9, v29) )
      {
LABEL_22:
        v13 = 2;
LABEL_23:
        MiUnlockStealVm(a4);
        if( (v19->Flags._bf_0 & 7) != 3 )
          return v13;
        return 0;
      }
    }
    else
    {
      LODWORD(v32) = MI_READ_PTE_LOCK_FREE(v41);
      v40 = v32;
      if( (v32 & 1) == 0 )
        goto LABEL_22;
      LODWORD(v33) = MI_READ_PTE_LOCK_FREE((INT64)&v40);
      if( ((v33 >> 12) & 0xFFFFFFFFFi64) != v29 )
        goto LABEL_22;
    }
    if( ((unsigned int)(*(_DWORD *)(a4 + 48) - 2) <= 1
       || (*(_DWORD *)(a4 + 8) & 0x20) != 0
       || (*(_BYTE *)a1 & 1) != 0 && (*(_BYTE *)(a1 + 35) & 8) == 0)
      && v29 <= 0xFFFFFFFFFi64
      && (MmGetPfnDb()[v29].u4._bf_0 & 0x4000000000000i64) != 0
      && *(_UNICODE_STRING **)(*(&stru_140C4DB30 + 267) + 8 * ((*(_QWORD *)(a1 + 40) >> 39) & 0x3FFi64)) == antNameB )
    {
      LOBYTE(v34) = MI_PFN_IS_PROTO((_UNICODE_STRING *)a1, antNameB, 1u, v30);
      if( !v34 )
      {
        LOBYTE(v36) = MiIsPfnFileOnly(v35);
        if( v36 != v37 )
        {
          LOBYTE(v38) = MiIsPfnFromSlabAllocation(a1);
          if( !v38 )
            return v39;
        }
      }
    }
    goto LABEL_23;
  }
  return 0;
}

Referenced by: