MiFindEmptyAddressRange

NTSTATUS __stdcall MiFindEmptyAddressRange(
        UINT64 SizeOfRange,
        UINT64 Alignment,
        PVOID HighestVadAddress,
        UINT64 ProtectionMask,
        UINT64 InternalFlags,
        PVOID *Base,
        UINT64 *HINTHonored){
  PVOID *v7; 
  VOID *v8; 
  char *v10; 
  int v13; 
  _DWORD *v14; 
  _EPROCESS *Process; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  UINT64 v18; 
  UINT64 v19; 
  UINT64 v20; 
  __int64 v21; 
  UINT64 ClearBits; 
  UINT64 v23; 
  NTSTATUS result; 
  unsigned __int64 HighestUserAddress; 
  unsigned __int64 v26; 
  unsigned __int64 v27; 
  PVOID *v28; 
  UINT64 v29; 
  UINT64 v30; 
  bool v31; 
  _RTL_AVL_TREE *p_VadRoot; 
  __int64 v33; 
  UINT64 v34; 
  _EPROCESS *v35; 
  UINT64 InternalFlagsa; 
  unsigned __int64 Basea; 
  _QWORD *v40; 
  _DWORD *v41; 

  v7 = Base;
  v8 = (VOID *)ProtectionMask;
  v10 = (char *)HighestVadAddress;
  if( (unsigned __int64)Base - InternalFlags + 1 < Alignment )
    return -1073741801;
  v13 = 1;
  v14 = v41;
  Process = KeGetCurrentThread()->ApcState.Process;
  v35 = Process;
  *v41 = 1;
  if( ((unsigned __int8)HINTHonored & 2) != 0 )
  {
    HighestUserAddress = (unsigned __int64)Process->HighestUserAddress;
    v16 = (unsigned __int8)*(_DWORD *)(SizeOfRange + 64);
    v17 = *(_QWORD *)(SizeOfRange + 48) >> 16;
    InternalFlagsa = v17;
    Basea = v16;
    if( HighestUserAddress > 0x100000000i64 )
    {
      v17 = (HighestUserAddress >> 16) - (unsigned __int8)v17 - 1;
      InternalFlagsa = v17;
    }
    Process = v35;
    if( !(unsigned __int8)*(_DWORD *)(SizeOfRange + 64) )
    {
      v16 = 1i64;
      Basea = 1i64;
    }
  }
  else
  {
    v16 = 0i64;
    v13 = 0;
    v17 = 0i64;
    Basea = 0i64;
    InternalFlagsa = 0i64;
  }
  if( !ProtectionMask )
  {
    if( v10 == (char *)0x10000 )
    {
      v18 = Alignment + 0xFFFF;
    }
    else
    {
      if( (unsigned __int64)(v10 - 0x200000) > 0x7FE00000 || ((unsigned __int64)(v10 - 1) & Alignment) != 0 )
        goto LABEL_35;
      v18 = Alignment;
    }
    v19 = v18 >> 16;
    if( !InternalFlags && (unsigned __int64)v7 >= (*(_QWORD *)(SizeOfRange + 40) << 16) + 0xFFFFi64 )
    {
      while( 1 )
      {
        v20 = *(_QWORD *)(SizeOfRange + 16);
        if( v19 != 1 && v19 >= *(_QWORD *)(SizeOfRange + 24) )
          v20 = *(_QWORD *)(SizeOfRange + 32);
        v21 = *(_QWORD *)(SizeOfRange + 8) - *(&stru_140C4DB30 + 174);
        if( v13 == 1 )
        {
          v26 = v20 + 8 * v21;
          if( v26 < v16 || v26 >= v17 )
          {
            v20 = v16;
            *v14 = 0;
          }
        }
        if( v10 == (char *)0x10000 )
          ClearBits = RtlFindClearBitsEx((_RTL_BITMAP_EX *)SizeOfRange, v19, v20);
        else
          LODWORD(ClearBits) = MiFindClearVadBitsAligned((_RTL_BITMAP *)SizeOfRange, (UINT64)v10, v19, v20);
        v23 = ClearBits;
        if( ClearBits != -1i64 )
        {
          if( v13 != 1 || (v27 = ClearBits + 8 * v21, v27 >= Basea) && v27 < InternalFlagsa )
          {
            *v40 = (v23 + 8i64 * (*(_QWORD *)(SizeOfRange + 8) - *(&stru_140C4DB30 + 174))) << 16;
            return 0;
          }
        }
        if( MiExpandVadBitMap((_MI_VAD_ALLOCATION_CELL *)SizeOfRange, v19) != 1 )
          break;
        v10 = (char *)HighestVadAddress;
        v14 = v41;
        v17 = InternalFlagsa;
        v16 = Basea;
      }
      if( v13 == 1 )
        return -1073741801;
      v10 = (char *)HighestVadAddress;
      v14 = v41;
      v17 = InternalFlagsa;
      v16 = Basea;
      Process = v35;
    }
    v8 = (VOID *)ProtectionMask;
  }
LABEL_35:
  *v14 = 0;
  if( v13 == 1 )
  {
    v28 = (PVOID *)(v17 << 16);
    if( v7 > v28 )
      v7 = v28;
  }
  v29 = *(_QWORD *)(SizeOfRange + 56);
  v30 = InternalFlags;
  if( v29 > InternalFlags )
    v30 = v29;
  v31 = v30 < (unsigned __int64)v7;
  if( v30 > (unsigned __int64)v7 )
  {
    if( (Process->MitigationFlags & 0x20) == 0 || (v33 = 0x3FFFFFFFi64, (unsigned __int64)v7 <= 0x3FFFFFFF) )
      v33 = 0xFFFFFFi64;
    v30 &= v33;
    if( !v30 || v30 > (unsigned __int64)v7 )
      v30 = 0x10000i64;
    if( v13 == 1 && v30 < v29 )
      v30 = v16 << 16;
    if( v30 < InternalFlags )
      v30 = InternalFlags;
    v31 = v30 < (unsigned __int64)v7;
  }
  if( !v31 || (unsigned __int64)v7 - v30 + 1 < Alignment )
    return -1073741801;
  p_VadRoot = &Process->VadRoot;
  MiFindEmptyAddressRangeInTree(&Process->VadRoot, Alignment, (UINT64)v10, v8);
  if( result < 0 )
  {
    v34 = Basea << 16;
    if( v13 != 1 )
      v34 = 0x10000i64;
    if( v34 < InternalFlags )
      v34 = InternalFlags;
    if( v34 < v30 )
      MiFindEmptyAddressRangeInTree(p_VadRoot, Alignment, (UINT64)HighestVadAddress, v8);
  }
  return result;
}

Referenced by: