MiMakeHyperRangeAccessible

NTSTATUS __stdcall MiMakeHyperRangeAccessible(PVOID StartVa, PVOID EndVa, UINT64 *PagesCharged){
  UINT64 v3; 
  _EPROCESS *Process; 
  _MMSUPPORT_INSTANCE *p_Instance; 
  unsigned __int8 v8; 
  volatile __int32 *v9; 
  UINT8 v10; 
  int v11; 
  int v12; 
  _MMPTE *PteBase; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  _MMPTE *v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  _MMPTE *PteLimit; 
  _MMSUPPORT_FULL *AnyMultiplexedVm; 
  NTSTATUS v26; 
  INT64 v27; 
  _MMPTE *v28; 
  unsigned __int64 v29; 
  UINT64 v30; 
  unsigned __int64 v31; 
  UINT64 v32; 
  NTSTATUS result; 
  unsigned __int64 v34; 
  int v35; 
  UINT8 CurrentIrql; 
  INT64 v37; 
  __int64 v38; 
  unsigned __int64 v39; 
  _MMSUPPORT_INSTANCE *v40; 
  UINT64 *v41; 
  unsigned __int64 v42; 
  ULONG_PTR TargetProcess[2]; 
  __int128 v44; 
  __int64 v45; 
  unsigned __int64 v46; 
  _QWORD v47[22]; 

  v3 = 0i64;
  v41 = PagesCharged;
  HIDWORD(v37) = 0;
  v42 = 0i64;
  Process = KeGetCurrentThread()->ApcState.Process;
  *(_QWORD *)TargetProcess = Process;
  *PagesCharged = 0i64;
  LODWORD(v37) = 0;
  p_Instance = &Process->Vm.Instance;
  v8 = Process->Vm.Instance.Flags._bf_0 & 7;
  v40 = p_Instance;
  if( v8 >= 6u )
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
  }
  else
  {
    if( v8 == 2 )
      v9 = (volatile __int32 *)((char *)&stru_140C4DB30 + 6544);
    else
      v9 = (volatile __int32 *)&p_Instance[1];
    v10 = KeGetCurrentIrql();
    __writecr8(2ui64);
    _m_prefetchw((const void *)v9);
    v11 = *v9 & 0x7FFFFFFF;
    if( v11 != _InterlockedCompareExchange(v9, v11 + 1, v11) )
      ExpWaitForSpinLockSharedAndAcquire((INT64 *)v9, v10);
    if( *((_DWORD *)v9 + 1) )
      _InterlockedExchange(v9 + 1, 0);
    CurrentIrql = v10;
  }
  v12 = 0;
  v35 = 0;
  PteBase = MmGetPteBase();
  v14 = (unsigned __int64)PteBase + (((unsigned __int64)StartVa >> 9) & 0x7FFFFFFFF8i64);
  v46 = v14;
  v15 = (unsigned __int64)PteBase + (((unsigned __int64)EndVa >> 9) & 0x7FFFFFFFF8i64);
  while( 1 )
  {
    v38 = 0i64;
    v16 = 0i64;
    v39 = 0i64;
    v17 = 0i64;
    v18 = v14;
    if( v14 <= v15 )
    {
      v19 = (_QWORD)PteBase << 25;
      v45 = (_QWORD)PteBase << 25;
      v20 = (__int64)((v15 << 25) - ((_QWORD)PteBase << 25)) >> 16;
      while( 1 )
      {
        v44 = 0i64;
        memset((char *)v47 + 2, 0i64, 0xAEu);
        v21 = MmGetPteBase();
        LOWORD(v47[0]) = 2145;
        v22 = (__int64)((v18 << 25) - v19) >> 16;
        v23 = v22;
        if( v22 >= (unsigned __int64)v21 )
        {
          PteLimit = MmGetPteLimit();
          do
          {
            if( v23 > (unsigned __int64)PteLimit )
              break;
            v23 = (__int64)((v23 << 25) - v19) >> 16;
          }
          while( v23 >= (unsigned __int64)v21 );
          p_Instance = v40;
        }
        if( v23 >= 0xFFFF800000000000ui64 && (v23 < *(&stru_140C4DB30 + 937) || v23 > *(&stru_140C4DB30 + 175)) )
          AnyMultiplexedVm = (_MMSUPPORT_FULL *)MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v21);
        else
          AnyMultiplexedVm = &KeGetCurrentThread()->ApcState.Process->Vm;
        v26 = MiFastLockLeafPageTable((INT64)AnyMultiplexedVm, v22);
        if( v26 )
        {
          LODWORD(v44) = v26 - 1;
          v28 = MmGetPteBase();
          v29 = (unsigned __int64)v28 + ((v22 >> 9) & 0x7FFFFFFFF8i64);
          *((_QWORD *)&v44 + 1) = v29;
        }
        else
        {
          LOWORD(v47[0]) |= 4u;
          v47[21] = &v44;
          v47[2] = 0i64;
          v47[3] = AnyMultiplexedVm;
          BYTE2(v47[0]) = BYTE2(v47[0]) & 0xE3 | 4;
          v47[20] = MiGetNextPageTableTail;
          BYTE6(v47[0]) = CurrentIrql;
          v47[4] = v22;
          v47[5] = v20;
          MiWalkPageTables((INT64)v47);
          v29 = *((_QWORD *)&v44 + 1);
          v28 = MmGetPteBase();
        }
        if( v29 )
        {
          v30 = (UINT64)v28 + ((v29 >> 9) & 0x7FFFFFFFF8i64);
          if( v29 == v18 )
          {
            v31 = v15;
            if( (v18 & 0xFFFFFFFFFFFFF000ui64) + 4088 <= v15 )
              v31 = (v18 & 0xFFFFFFFFFFFFF000ui64) + 4088;
            if( v18 <= v31 )
            {
              do
              {
                if( !*(_QWORD *)v18 )
                  MiMakeHyperPteDemandZero((UINT64 *)v18, v27, (INT64)&v37);
                v18 += 8i64;
              }
              while( (v18 & 0xFFF) != 0 && v18 <= v31 );
              p_Instance = v40;
              v3 = 0i64;
            }
            MiUnlockPageTableInternal((INT64)p_Instance, v30);
            goto LABEL_33;
          }
          MiUnlockPageTableInternal((INT64)p_Instance, (UINT64)v28 + ((v29 >> 9) & 0x7FFFFFFFF8i64));
          v34 = v29 - 8;
        }
        else
        {
          v34 = v15;
        }
        MiFillHyperPtes(v18, v34, CurrentIrql, (INT64)&v37);
        v18 = v34 + 8;
LABEL_33:
        v19 = v45;
        if( v18 > v15 )
        {
          v16 = v39;
          v17 = v38;
          v12 = v35;
          break;
        }
      }
    }
    if( v12 || !v17 )
      break;
    MiUnlockWorkingSetShared(p_Instance, CurrentIrql);
    v42 = v16;
    result = MiChargeFullProcessCommitment(TargetProcess[0], v17 + v16);
    if( result < 0 )
      return result;
    LODWORD(v37) = 1;
    *v41 = v17;
    MiLockWorkingSetShared();
    v14 = v46;
    v12 = 1;
    v35 = 1;
    PteBase = MmGetPteBase();
  }
  if( v16 )
  {
    _InterlockedExchangeAdd64((volatile signed __int64 *)&MiGetSharedVm(p_Instance)->ChargedWslePages, v16);
    v16 = v39;
    v17 = v38;
  }
  MiUnlockWorkingSetShared(p_Instance, CurrentIrql);
  v32 = *v41;
  if( v17 != *v41 )
  {
    *v41 = v17;
    v3 = v32 - v17;
  }
  if( v16 != v42 )
    v3 += v42 - v16;
  if( v3 )
    MiReturnFullProcessCommitment(*(_EPROCESS **)TargetProcess, v3);
  return 0;
}

Referenced by: