MiLockAddressSpaceToo

VOID __stdcall MiLockAddressSpaceToo(_EPROCESS *Process, _MMVAD_SHORT *LockedVad){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *p_AddressCreationLock; 
  _ETHREAD *v5; 
  unsigned __int8 AbEntrySummary; 
  __int64 v7; 
  __int64 v8; 
  NTSTATUS SessionId; 
  bool v10; 
  __int64 AbOrphanedEntrySummary; 
  UINT64 a3; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.SpecialApcDisable;
  LODWORD(a3) = 0;
  p_AddressCreationLock = &Process->AddressCreationLock;
  v5 = (_ETHREAD *)KeGetCurrentThread();
  --v5->Tcb.SpecialApcDisable;
  if( ++v5->Tcb.AbAllocationRegionCount != 1 )
  {
    v8 = 0i64;
    goto LABEL_9;
  }
  AbEntrySummary = v5->Tcb.AbEntrySummary;
  if( !AbEntrySummary )
  {
    if( !v5->Tcb.AbOrphanedEntrySummary )
    {
      v8 = 0i64;
      goto LABEL_9;
    }
    AbOrphanedEntrySummary = v5->Tcb.AbOrphanedEntrySummary;
    v5->Tcb.AbOrphanedEntrySummary = 0;
    AbEntrySummary = AbOrphanedEntrySummary | v5->Tcb.AbEntrySummary;
  }
  _BitScanForward((unsigned int *)&v7, AbEntrySummary);
  v5->Tcb.AbEntrySummary = AbEntrySummary & ~(1 << v7);
  v8 = (__int64)&v5->Tcb.LockEntries[v7];
  if( !v8 )
  {
LABEL_9:
    _interlockedbittestandset((volatile signed __int32 *)&v5->Tcb.116 + 1, 0x10u);
    goto LABEL_10;
  }
  if( (unsigned __int64)p_AddressCreationLock >= 0xFFFF800000000000ui64
    && *((_BYTE *)&stru_140C4DB30 + (((unsigned __int64)p_AddressCreationLock >> 39) & 0x1FF) + 6872) == 1 )
  {
    SessionId = MmGetSessionIdEx(v5->Tcb.ApcState.Process);
  }
  else
  {
    SessionId = -1;
  }
  *(_DWORD *)(v8 + 40) = SessionId;
  *(_QWORD *)(v8 + 32) = (unsigned __int64)p_AddressCreationLock & 0x7FFFFFFFFFFFFFFCi64;
LABEL_10:
  --v5->Tcb.AbAllocationRegionCount;
  KiAbThreadRemoveBoosts(&v5->Tcb, p_AddressCreationLock, &a3);
  v10 = v5->Tcb.SpecialApcDisable++ == -1;
  if( v10 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v5->Tcb.ApcState.ApcListHead[0].Flink != &v5->Tcb.152 )
    KiCheckForKernelApcDelivery();
  if( _interlockedbittestandset64((volatile signed __int32 *)p_AddressCreationLock, 0i64) )
  {
    if( v8 )
      KeAbPostReleaseEx(p_AddressCreationLock, (VOID *)v8);
    MiUnlockVad(CurrentThread, LockedVad);
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(p_AddressCreationLock, 0i64);
    CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 1u;
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockExclusiveEx(&LockedVad->PushLock, 0i64);
    CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 0x80u;
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  else
  {
    if( v8 )
      *(_BYTE *)(v8 + 26) |= 1u;
    CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0 |= 1u;
  }
}

Referenced by: