MiFinishCreateSection
NTSTATUS __stdcall MiFinishCreateSection(
VOID *ProcessHandle,
VOID *BaseAddress,
VOID *Buffer,
UINT64 BufferSize,
UINT64 *NumberOfBytesRead){
__int64 *v5;
__int64 v7;
unsigned int v8;
int v9;
bool v10;
int v11;
struct _DMA_ADAPTER *v12;
char v13;
int v14;
int v15;
NTSTATUS v16;
PADAPTER_OBJECT v17;
int v18;
int DmaOperations;
__int64 *v21;
int v22;
int v23;
int PerSessionProtos;
_DMA_OPERATIONS *v25;
__int64 v26;
unsigned __int64 v27;
_ETHREAD *CurrentThread;
NTSTATUS EmptyAddressRangeDownTree;
PADAPTER_OBJECT v30;
bool v31;
unsigned __int64 v32;
__int64 v33;
unsigned __int64 v34;
__int64 v35;
__int64 v36;
PADAPTER_OBJECT DmaAdapter;
unsigned __int64 v38;
v5 = (__int64 *)*((_QWORD *)ProcessHandle + 8);
v38 = 0i64;
DmaAdapter = 0i64;
v7 = *v5;
*((_QWORD *)ProcessHandle + 15) = v5;
v8 = v5[7] & 0xFFF7FFFF;
v9 = *((_DWORD *)ProcessHandle + 35) & 0x7FFFFFFF;
*((_DWORD *)ProcessHandle + 34) = v8;
v10 = (*((_DWORD *)ProcessHandle + 4) & 0x1000000) == 0;
*((_DWORD *)ProcessHandle + 35) = v9;
if( !v10 )
{
v22 = *(_DWORD *)ProcessHandle;
v23 = v8;
if( (*(_DWORD *)ProcessHandle & 0x400) == 0 )
{
v23 = v8 | 0x80000;
*((_DWORD *)ProcessHandle + 34) = v8 | 0x80000;
}
v8 = v23;
if( *((_BYTE *)ProcessHandle + 24) <= 1u && (v22 & 0x80000) == 0 )
*((_DWORD *)ProcessHandle + 35) = v9 | 0x80000000;
}
v11 = *((_DWORD *)v5 + 14);
if( (v11 & 0x4000000) != 0 )
{
PerSessionProtos = MiCreatePerSessionProtos((_CONTROL_AREA *)v5, *((unsigned int *)ProcessHandle + 42));
if( PerSessionProtos < 0 )
{
HalPutDmaAdapter(*((PADAPTER_OBJECT *)ProcessHandle + 7));
MiDereferenceFailedControlArea((INT64 *)ProcessHandle);
return PerSessionProtos;
}
*((_DWORD *)ProcessHandle + 35) ^= (*((_DWORD *)ProcessHandle + 35) ^ (*((_DWORD *)ProcessHandle + 42) << 12)) & 0x7FFFF000;
}
else if( !*((_QWORD *)ProcessHandle + 6) && (*((_DWORD *)ProcessHandle + 7) & 0x44) != 0 && (v11 & 0x20) == 0 )
{
if( v5[8] )
{
*((_DWORD *)ProcessHandle + 34) = v8 | 0x8000000;
_InterlockedIncrement((volatile signed __int32 *)v5 + 23);
if( !ObCheckActiveHandles(*((PVOID *)ProcessHandle + 7)) )
{
_InterlockedDecrement((volatile signed __int32 *)v5 + 23);
HalPutDmaAdapter(*((PADAPTER_OBJECT *)ProcessHandle + 7));
MiDereferenceFailedControlArea((INT64 *)ProcessHandle);
return -1073741788;
}
}
}
v12 = (struct _DMA_ADAPTER *)*((_QWORD *)ProcessHandle + 7);
v13 = 0;
if( v12 )
{
if( (HIDWORD(v12->DmaOperations->FreeAdapterChannel) & 0x10) != 0 )
v13 = 1;
else
HalPutDmaAdapter(v12);
}
v14 = 128;
if( (v5[7] & 0x20) != 0 || !v5[8] )
{
v15 = 8 * *(_DWORD *)(v7 + 8) + 64;
v21 = v5 + 16;
do
{
v21 = (__int64 *)v21[2];
v14 += 56;
}
while( v21 );
}
else
{
v15 = 0;
v14 = 144 * *((_DWORD *)v5 + 70) + 152;
}
v16 = ObCreateObjectEx(
*((_BYTE *)ProcessHandle + 72),
MmSectionObjectType,
*((_QWORD *)ProcessHandle + 1),
*((_BYTE *)ProcessHandle + 72),
v36,
64,
v15,
v14,
&DmaAdapter,
0i64);
if( v16 < 0 )
{
if( (*((_DWORD *)ProcessHandle + 34) & 0x8000000) != 0 )
{
_InterlockedDecrement((volatile signed __int32 *)v5 + 23);
}
else if( (v5[7] & 0x4000000) != 0 )
{
MiDereferencePerSessionProtos(v5, (*((_DWORD *)ProcessHandle + 35) >> 12) & 0x7FFFF);
}
if( v13 == 1 )
HalPutDmaAdapter(*((PADAPTER_OBJECT *)ProcessHandle + 7));
MiDereferenceFailedControlArea((INT64 *)ProcessHandle);
return v16;
}
v17 = DmaAdapter;
*DmaAdapter = *((PADAPTER_OBJECT)ProcessHandle + 5);
v17[1] = *((PADAPTER_OBJECT)ProcessHandle + 6);
v17[2] = *((PADAPTER_OBJECT)ProcessHandle + 7);
v17[3] = *((PADAPTER_OBJECT)ProcessHandle + 8);
v17[1].DmaOperations = 0i64;
if( v13 == 1 )
{
v25 = (_DMA_OPERATIONS *)*((_QWORD *)ProcessHandle + 7);
v17[2].DmaOperations = v25;
if( (v5[7] & 0x20) != 0 )
v26 = (unsigned __int64)v25 | 1;
else
v26 = (unsigned __int64)v25 | 2;
v17[2].DmaOperations = (_DMA_OPERATIONS *)v26;
}
if( (*(_DWORD *)ProcessHandle & 1) != 0 )
goto LABEL_17;
LODWORD(v17[3].DmaOperations) |= 0x10000u;
v18 = *((_DWORD *)ProcessHandle + 4);
DmaOperations = (int)v17[3].DmaOperations;
if( (v18 & 0x400000) != 0 )
{
DmaOperations |= 0x4000u;
LODWORD(v17[3].DmaOperations) = DmaOperations;
v18 = *((_DWORD *)ProcessHandle + 4);
}
if( (v18 & 0x200000) == 0 )
goto LABEL_17;
LODWORD(v17[3].DmaOperations) = DmaOperations | 0x40;
v27 = *(_QWORD *)&v17[3].Version;
if( v27 > qword_140C4C6E8 )
{
HalPutDmaAdapter(v17);
return -1073741801;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 243);
ExAcquirePushLockExclusiveEx((UINT64)&qword_140C4C6D0, 0i64);
EmptyAddressRangeDownTree = MiFindEmptyAddressRangeDownTree(
&qword_140C4C6C8,
v27,
0x10000ui64,
0i64,
0x10000ui64,
qword_140C4C6E8,
&v38);
if( EmptyAddressRangeDownTree < 0 )
{
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C6D0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C6D0);
KeAbPostRelease(&qword_140C4C6D0);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
HalPutDmaAdapter(DmaAdapter);
return EmptyAddressRangeDownTree;
}
v30 = DmaAdapter;
v31 = 0;
v32 = v38 >> 12;
v17[1].DmaOperations = (_DMA_OPERATIONS *)(v38 >> 12);
*(_QWORD *)&v30[2].Version = ((v27 + 4095) >> 12) + v32 - 1;
v33 = qword_140C4C6C8;
v34 = (unsigned __int64)v17[1].DmaOperations;
if( !qword_140C4C6C8 )
goto LABEL_55;
while( v34 <= (*(unsigned int *)(v33 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v33 + 33) << 32))
&& v34 < (*(unsigned int *)(v33 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v33 + 32) << 32)) )
{
v35 = *(_QWORD *)v33;
if( !*(_QWORD *)v33 )
goto LABEL_55;
LABEL_60:
v33 = v35;
}
v35 = *(_QWORD *)(v33 + 8);
if( v35 )
goto LABEL_60;
v31 = 1;
LABEL_55:
RtlAvlInsertNodeEx((unsigned __int64 *)&qword_140C4C6C8, v33, v31, v30);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C4C6D0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)&qword_140C4C6D0);
KeAbPostRelease(&qword_140C4C6D0);
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
v17 = DmaAdapter;
LABEL_17:
*((_QWORD *)ProcessHandle + 18) = v17;
return v16;
}Referenced by:
MiCreateSection