MiCreateUltraThreadContextHelper

NTSTATUS __stdcall MiCreateUltraThreadContextHelper(INT64 a1, UINT64 a2, UINT64 a3){
  signed __int32 v3; 
  unsigned int v4; 
  bool v6; 
  signed __int32 v7; 
  UINT64 v8; 
  int v9; 
  __int64 v10; 
  _MMPFN *PfnDb; 
  __int64 v12; 
  UINT64 *p_Long; 
  __int64 v14; 
  _QWORD *v16; 
  struct _KPRCB *CurrentPrcb; 
  __int64 CachedResidentAvailable; 
  signed __int32 v19; 

  v3 = *(&stru_140C4DB30 + 911);
  v4 = a3;
  if( *(&stru_140C4DB30 + 911) != *(&stru_140C4DB30 + 910) )
  {
    while( 1 )
    {
      v7 = _InterlockedCompareExchange((_DWORD *)&stru_140C4DB30 + 911, v3 + 1, v3);
      v6 = v3 == v7;
      v3 = v7;
      if( v6 )
        break;
      if( v7 == *(&stru_140C4DB30 + 910) )
        return 0;
    }
    *(_QWORD *)a1 = 0i64;
    v8 = (unsigned int)a2;
    *(__m128i *)(a1 + 8) = _mm_load_si128((const __m128i *)&_xmm_ffffffffffffffffffffffffffffffff);
    if( !(_DWORD)a2 )
      goto LABEL_11;
    if( (unsigned int)a2 > 2ui64 )
      v8 = 2i64;
    MiAcquireNonPagedResources(&Irp, (unsigned int)v8);
    if( v9 >= 0 )
    {
      v10 = 0i64;
      if( v8 )
      {
        PfnDb = MmGetPfnDb();
        while( 1 )
        {
          LODWORD(v12) = MiGetPage((ULONG_PTR *)&Irp.Core.PartitionId, v4, 0x30Aui64);
          if( v12 == -1 )
            break;
          p_Long = &PfnDb[v12].OriginalPte.u.Long;
          *p_Long = ZeroPte.u.Long;
          MiSetOriginalPtePfnFromFreeList(p_Long);
          *(_QWORD *)(a1 + 8 * v10 + 8) = v14;
          v10 = (unsigned int)(v10 + 1);
          if( (unsigned int)v10 >= v8 )
            goto LABEL_11;
        }
        _InterlockedDecrement((_DWORD *)&stru_140C4DB30 + 911);
        if( (_DWORD)v10 )
        {
          v16 = (_QWORD *)(a1 + 8 * v10 + 8);
          do
          {
            MiReleaseFreshPage(&PfnDb[*--v16]);
            *v16 = -1i64;
            LODWORD(v10) = v10 - 1;
          }
          while( (_DWORD)v10 );
        }
        MiReturnCommit(&Irp, v8);
        CurrentPrcb = KeGetCurrentPrcb();
        CachedResidentAvailable = (int)CurrentPrcb->CachedResidentAvailable;
        if( (_DWORD)CachedResidentAvailable != -1 )
        {
          if( v8 + CachedResidentAvailable <= 0x100 )
          {
            do
            {
              if( v8 >= 0x80000 )
                break;
              v19 = _InterlockedCompareExchange(
                      (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                      CachedResidentAvailable + v8,
                      CachedResidentAvailable);
              v6 = (_DWORD)CachedResidentAvailable == v19;
              LODWORD(CachedResidentAvailable) = v19;
              if( v6 )
                return 0;
            }
            while( v19 != -1 && v8 + v19 <= 0x100 );
          }
          if( (int)CachedResidentAvailable > 192
            && (_DWORD)CachedResidentAvailable != -1
            && (_DWORD)CachedResidentAvailable == _InterlockedCompareExchange(
                                                    (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                                                    192,
                                                    CachedResidentAvailable) )
          {
            v8 += (int)CachedResidentAvailable - 192;
          }
        }
        if( v8 )
          _InterlockedExchangeAdd64((_QWORD *)&stru_140C50B28 + 883, v8);
        return 0;
      }
LABEL_11:
      *(_BYTE *)(a1 + 24) = 1;
      return 1;
    }
    _InterlockedDecrement((_DWORD *)&stru_140C4DB30 + 911);
  }
  return 0;
}

Referenced by: