MiSessionInsertImage

NTSTATUS __stdcall MiSessionInsertImage(VOID *BaseAddress, _CONTROL_AREA *ControlArea){
  NTSTATUS v3; 
  __int64 v4; 
  _MI_PARTITION *v5; 
  INT64 v6; 
  _RTL_BALANCED_NODE *Pool; 
  UINT64 TotalNumberOfPtes; 
  __int64 v9; 
  NTSTATUS v10; 
  NTSTATUS v11; 
  _MMSUPPORT_SHARED *SharedVm; 
  UINT64 v13; 
  BOOL v14; 
  UINT64 v16; 
  int active; 
  _MMSUPPORT_INSTANCE *Vm; 
  __int64 v19; 
  _MM_SESSION_SPACE *Session; 
  __int64 v21[25]; 
  UINT8 OldIrql; 
  UINT8 WsIrql; 

  v3 = 0;
  OldIrql = 0;
  memset(v21, 0i64, 0x90u);
  Session = KeGetCurrentThread()->ApcState.Process->Session;
  v4 = *((unsigned __int16 *)Session + 215);
  v5 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v4);
  Vm = MiGetSessionVm((INT64)Session, v6, v4);
  Pool = (_RTL_BALANCED_NODE *)MiAllocatePool(64i64, 0x60ui64, 0x69486D4Dui64);
  if( !Pool )
    return -1073741801;
  TotalNumberOfPtes = ControlArea->Segment->TotalNumberOfPtes;
  if( ControlArea->Segment->TotalNumberOfPtes && !MiChargeCommit(v5, (unsigned int)TotalNumberOfPtes, 0i64) )
  {
    active = -1073741670;
LABEL_25:
    ExFreePoolWithTag(Pool, 0);
    return active;
  }
  LOBYTE(v9) = MiBytesToMapSystemImage((_FAST_MUTEX *)(TotalNumberOfPtes << 12));
  v19 = v9;
  v10 = MiControlAreaRequiresCharge((INT64)ControlArea);
  v11 = v10;
  if( !v10 )
  {
    MiReturnCommit(v5, TotalNumberOfPtes);
    active = -1073740277;
    goto LABEL_25;
  }
  if( v10 == 2 )
  {
    active = MiReferenceActiveSubsection((_SUBSECTION *)&ControlArea[1], 0x108ui64, 0x11u);
    if( active < 0 )
    {
      MiReturnCommit(v5, TotalNumberOfPtes);
      goto LABEL_25;
    }
  }
  SharedVm = MiGetSharedVm(Vm);
  WsIrql = ExAcquireSpinLockExclusive((INT64 *)&SharedVm->WorkingSetLock);
  SharedVm->GoodCitizenWaiting = 0;
  MmLockLoadedModuleListExclusive(&OldIrql);
  v13 = *((_QWORD *)Session + 11);
  v14 = 0;
  if( !v13 )
  {
LABEL_7:
    memset(Pool, 0i64, 0x60u);
    Pool[1].ParentValue = (unsigned __int64)BaseAddress | 3;
    Pool[3].Children[0] = (_RTL_BALANCED_NODE *)TotalNumberOfPtes;
    Pool[2].Children[0] = (_RTL_BALANCED_NODE *)((char *)BaseAddress + v19 - 1);
    HIDWORD(Pool[2].Right) = 1;
    LODWORD(Pool[2].Right) = *((_DWORD *)Session + 2);
    Pool[3].Children[1] = (_RTL_BALANCED_NODE *)ControlArea;
    Pool[3].ParentValue = -2i64;
    if( v11 == 2 )
      *((_BYTE *)&Pool[2].0 + 1) = 1;
    RtlAvlInsertNodeEx((_RTL_BALANCED_NODE **)Session + 11, v13, v14, Pool);
    ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
    __writecr8(OldIrql);
    MiUnlockWorkingSetExclusive(Vm, WsIrql);
    _InterlockedExchangeAdd64((volatile signed __int64 *)Session + 6, TotalNumberOfPtes);
    v21[0] = (__int64)ControlArea;
    MiManageSubsectionView(v21, &Pool[1], 3i64);
    return v3;
  }
  while( (unsigned __int64)BaseAddress > *(_QWORD *)(v13 + 48) )
  {
    v16 = *(_QWORD *)(v13 + 8);
    if( !v16 )
    {
      v14 = 1;
      goto LABEL_7;
    }
LABEL_15:
    v13 = v16;
  }
  if( (unsigned __int64)BaseAddress < (*(_QWORD *)(v13 + 40) & 0xFFFFFFFFFFFFFFFCui64) )
  {
    v16 = *(_QWORD *)v13;
    if( !*(_QWORD *)v13 )
      goto LABEL_7;
    goto LABEL_15;
  }
  ++*(_DWORD *)(v13 + 60);
  ExReleaseSpinLockExclusiveFromDpcLevel(&PsLoadedModuleSpinLock);
  __writecr8(OldIrql);
  MiUnlockWorkingSetExclusive(Vm, WsIrql);
  v3 = 272;
  ExFreePoolWithTag(Pool, 0);
  MiReturnCommit(v5, TotalNumberOfPtes);
  if( v11 == 2 )
    MiReturnCrossPartitionControlAreaCharges((INT64)ControlArea);
  return v3;
}

Referenced by: