MmCreateKernelStack

VOID *__stdcall MmCreateKernelStack(UINT64 StackFlags, UINT16 PreferredNode, _ETHREAD *StackOwner){
  __int64 v3; 
  unsigned int v4; 
  _MI_PARTITION *v5; 
  _EPROCESS *Process; 
  unsigned __int64 v7; 
  unsigned int v8; 
  unsigned int v9; 
  __int64 i; 
  __int64 v11; 
  __int16 v12; 
  PSLIST_ENTRY v13; 
  _SLIST_ENTRY *Next; 
  unsigned __int64 v15; 
  _SLIST_ENTRY *v16; 
  _MMPTE *PteBase; 
  UINT64 *v18; 
  __int64 v19; 
  unsigned __int64 v20; 
  _MMPFN *PfnDb; 
  UINT64 v22; 
  INT64 v23; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v26; 
  void *v27; 
  __int64 v28; 
  void *v29; 
  UINT64 v30; 
  _MMPTE *v31; 
  _MMPTE *v32; 
  _MMPTE *v33; 
  _KTBFLUSH_TYPE v34; 
  unsigned __int64 v35; 
  __int64 v36; 
  struct _KPRCB *v37; 
  __int64 CachedResidentAvailable; 
  bool v39; 
  signed __int32 v40; 
  UINT64 StackFlagsa; 
  unsigned __int8 CurrentIrql; 
  int v43; 
  UINT64 NumberOfPages; 
  UINT64 v45; 
  UINT16 PreferredNodea[4]; 
  unsigned int v47; 
  UINT64 SpinCount; 

  v47 = StackFlags;
  v3 = PreferredNode;
  v45 = 0i64;
  v4 = StackFlags;
  v5 = &Irp;
  if( (StackFlags & 0x10) != 0 )
  {
    v7 = -32i64;
    *(_QWORD *)PreferredNodea = -32i64;
    if( StackOwner )
      v5 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * StackOwner->Tcb.Process->Vm.Instance.PartitionId);
  }
  else if( StackOwner )
  {
    Process = StackOwner->Tcb.Process;
    v7 = (unsigned __int64)StackOwner;
    *(_QWORD *)PreferredNodea = StackOwner;
    v5 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * Process->Vm.Instance.PartitionId);
  }
  else
  {
    v7 = -16i64;
    *(_QWORD *)PreferredNodea = -16i64;
  }
  if( (StackFlags & 1) != 0 )
  {
    v8 = 18;
    v36 = 18i64;
    v43 = 18;
    if( (StackFlags & 4) == 0 )
      v36 = 6i64;
    NumberOfPages = v36;
  }
  else
  {
    v8 = *(&stru_140C4DB30 + 3532);
    v43 = *(&stru_140C4DB30 + 3532);
    NumberOfPages = *(&stru_140C4DB30 + 3532);
    if( (StackFlags & 0x10) != 0 )
    {
      CurrentPrcb = KeGetCurrentPrcb();
      v9 = 1;
      if( CurrentPrcb->ParentNode->Affinity.Reserved[0] == (_DWORD)v3 )
      {
        if( CurrentPrcb->CachedStack )
        {
          v26 = _InterlockedExchange64((volatile __int64 *)&CurrentPrcb->CachedStack, 0i64);
          if( v26 )
          {
            v27 = *(void **)(v26 - 16);
            v28 = v26 - 4080;
            v29 = (void *)((v26 - 4080) ^ *(&stru_140C4DB30 + 539));
            if( v27 != v29 )
              KeBugCheckEx(0x1Au, (PVOID)0x3470, (PVOID)v28, v27, v29);
            return(VOID *)((__int64)(((v28 & 0xFFFFFFFFFFFFF000ui64) << 16) + 0x10000000) >> 16);
          }
        }
      }
    }
    else
    {
      v9 = 0;
    }
    if( v5 == &Irp )
    {
      for( i = v9; ; i = 0i64 )
      {
        v11 = *(&stru_140C4DB30 + 22) + 176 * v3 + 32 * i;
        v12 = *(_WORD *)v11;
        if( *(_WORD *)v11 )
        {
          if( i == 1 )
          {
            CurrentIrql = 17;
          }
          else
          {
            CurrentIrql = KeGetCurrentIrql();
            __writecr8(2ui64);
          }
          v13 = RtlpInterlockedPopEntrySList((PSLIST_HEADER)v11);
          if( v13 )
          {
            if( v12 == 1 && !*(_DWORD *)(v11 + 28) )
              *(_DWORD *)(v11 + 28) = 1;
            Next = v13[-1].Next;
            v15 = (unsigned __int64)&v13[-255];
            v16 = (_SLIST_ENTRY *)((unsigned __int64)&v13[-255] ^ *(&stru_140C4DB30 + 539));
            if( Next != v16 )
              KeBugCheckEx(0x1Au, (PVOID)0x3470, (PVOID)v15, Next, v16);
            PteBase = MmGetPteBase();
            v18 = (unsigned __int64 *)((char *)&PteBase->u.Long + ((v15 >> 9) & 0x7FFFFFFFF8i64));
            v19 = (((_QWORD)v18 << 25) - ((_QWORD)PteBase << 25) + 0x10000000i64) >> 16;
            *(_QWORD *)PreferredNodea = v19;
            if( v9 != 1 )
            {
              v20 = (unsigned __int64)&v18[-*(&stru_140C4DB30 + 3532) + 1];
              MiPteInShadowRange((UINT64)&v45);
              PfnDb = MmGetPfnDb();
              do
              {
                v22 = *v18;
                v45 = v22;
                v23 = (INT64)&PfnDb[(v22 >> 12) & 0xFFFFFFFFFi64];
                LODWORD(SpinCount) = 0;
                if( _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) )
                {
                  do
                  {
                    do
                      KeYieldProcessorEx(&SpinCount);
                    while( *(__int64 *)(v23 + 24) < 0 );
                  }
                  while( _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) );
                  PfnDb = MmGetPfnDb();
                }
                if( v22 == *v18 )
                {
                  *(_QWORD *)v23 ^= (*(_QWORD *)v23 ^ (v7 >> 3)) & 0xFFFFFFFFFFEi64;
                  if( (*(_BYTE *)v23 & 1) == 0 )
                    MiMarkPfnTradable(v23, 1i64);
                  --v18;
                  PfnDb = MmGetPfnDb();
                }
                _InterlockedAnd64((volatile signed __int64 *)(v23 + 24), 0x7FFFFFFFFFFFFFFFui64);
              }
              while( (unsigned __int64)v18 >= v20 );
              v19 = *(_QWORD *)PreferredNodea;
              __writecr8(CurrentIrql);
            }
            return(VOID *)v19;
          }
          if( i != 1 )
            __writecr8(CurrentIrql);
        }
        ++*(_DWORD *)(v11 + 20);
        if( i != 1 )
        {
          v4 = v47;
          v8 = v43;
          break;
        }
        v9 = 0;
      }
    }
  }
  v30 = v8;
  if( MiChargeCommit(v5, v8, (v4 >> 1) & 1) )
  {
    v31 = MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 3432), (unsigned int)(v43 + 1));
    v32 = v31;
    if( !v31 )
    {
LABEL_70:
      MiReturnCommit(v5, v30);
      return 0i64;
    }
    v33 = v31;
    v19 = (__int64)(((_QWORD)v31 << 25) + ((v30 + 1) << 28) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
    if( (v4 & 5) == 1 )
      v33 = v31 + 12;
    if( MiChargeResident((ULONG_PTR *)&v5->Core.PartitionId, NumberOfPages, 0i64) )
    {
      LODWORD(StackFlagsa) = v3;
      v35 = NumberOfPages;
      if( MiAllocateKernelStackPages(
             (PVOID *)v5,
             (UINT64)&v33[1],
             (_KTHREAD *)NumberOfPages,
             PreferredNodea[0],
             StackFlagsa) )
      {
        if( v5 == &Irp )
          _InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 571, v30);
        return(VOID *)v19;
      }
      if( v5 == &Irp )
      {
        v37 = KeGetCurrentPrcb();
        CachedResidentAvailable = (int)v37->CachedResidentAvailable;
        if( (_DWORD)CachedResidentAvailable != -1 )
        {
          if( NumberOfPages + CachedResidentAvailable <= 0x100 )
          {
            do
            {
              v40 = _InterlockedCompareExchange(
                      (volatile signed __int32 *)&v37->CachedResidentAvailable,
                      CachedResidentAvailable + NumberOfPages,
                      CachedResidentAvailable);
              v39 = (_DWORD)CachedResidentAvailable == v40;
              LODWORD(CachedResidentAvailable) = v40;
              if( v39 )
                goto LABEL_69;
            }
            while( v40 != -1 && NumberOfPages + v40 <= 0x100 );
          }
          if( (int)CachedResidentAvailable > 192
            && (_DWORD)CachedResidentAvailable != -1
            && (_DWORD)CachedResidentAvailable == _InterlockedCompareExchange(
                                                    (volatile signed __int32 *)&v37->CachedResidentAvailable,
                                                    192,
                                                    CachedResidentAvailable) )
          {
            v35 = (int)CachedResidentAvailable - 192 + NumberOfPages;
          }
        }
      }
      if( v35 )
        _InterlockedExchangeAdd64((volatile signed __int64 *)&v5->Vp.ResidentAvailablePages, v35);
    }
LABEL_69:
    MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 3432), v32, (unsigned int)(v43 + 1), v34);
    goto LABEL_70;
  }
  return 0i64;
}

Referenced by: