MiValidateInPage

INT64 __fastcall MiValidateInPage(__int64 a1){
  _DWORD *v1; 
  ULONG_PTR v2; 
  int v3; 
  INT64 v5; 
  __int64 *v6; 
  __int64 v7; 
  int v8; 
  unsigned __int64 v9; 
  __int64 *v10; 
  unsigned int v11; 
  int v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  int v15; 
  int v16; 
  PVOID MappedSystemVa; 
  __int64 v18; 
  ULONG_PTR v19; 
  __int64 v20; 
  _MMPTE *PteBase; 
  char *v22; 
  unsigned __int64 v23; 
  INT64 *v24; 
  INT64 v25; 
  INT64 result; 
  int v27; 
  __int16 MdlFlags; 
  VOID *v29; 
  UINT64 v30; 
  INT64 v31; 
  UINT64 BugCheckOnFailure; 
  int Priority; 
  PMDL MemoryDescriptorList; 
  ULONG_PTR BugCheckParameter2; 
  int v36; 
  CHAR v37; 
  unsigned int v38; 
  VOID *MappingVa; 
  _EPROCESS *CallingProcess; 
  v1 = (_DWORD *)(a1 + 272);
  v2 = *(_QWORD *)(a1 + 208);
  v3 = *(_DWORD *)(a1 + 184);
  BugCheckParameter2 = v2;
  if( *(_QWORD *)(a1 + 256) )
    v1 = *(_DWORD **)(a1 + 256);
  v38 = 0;
  v5 = *(_QWORD *)(v2 + 96);
  MemoryDescriptorList = (PMDL)v1;
  v6 = (__int64 *)(v1 + 12);
  v7 = (unsigned int)v1[10];
  v8 = v1[11];
  v9 = ((unsigned __int64)(((_WORD)v8 + (unsigned __int16)v1[8]) & 0xFFF) + v7 + 4095) >> 12;
  CallingProcess = (_EPROCESS *)*((_QWORD *)KeGetCurrentThread() + 23);
  v10 = (__int64 *)&v1[2 * (unsigned int)v9 + 12];
  *(_QWORD *)(a1 + 96) += (unsigned int)(v3 - v7 - v8);
  v11 = v3 - v1[11] - v1[10];
  v12 = 2;
  v37 = 0;
  *(_DWORD *)(a1 + 188) += ((v11 & 0xFFF) != 0) + (v11 >> 12);
  v13 = *(_QWORD *)(v5 + 40);
  if( (v13 & 0xFFFFFFFFFFFFFFF8ui64) <= 8 )
    v12 = 0;
  v14 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)MmGetPfnDb() + 48 * *v6 + 16) >> 5) & 0x1F;
  v36 = v14;
  if( (*(_DWORD *)(v2 + 92) & 0xC0000) != 0 && (v12 & 2) != 0 )
  {
    v15 = v12 | 1;
  }
  else
  {
    v15 = v12;
    if( (MiFlags & 0x40000) != 0 && (v14 & 2) != 0 )
      v37 = 3;
  }
  if( (*(_DWORD *)(a1 + 192) & 0x10000) != 0 )
  {
    v15 |= 4u;
    if( (MiFlags & 0x4000) != 0 && (v15 & 1) != 0 )
      v15 &= ~4u;
  }
  v16 = v14 & 2;
  if( (v14 & 2) != 0 && (MiFlags & 0x40000) != 0 )
  {
    v31 = (INT64)MemoryDescriptorList;
    if( (MemoryDescriptorList->MdlFlags & 1) != 0 )
      MmUnmapLockedPages(MemoryDescriptorList->MappedSystemVa, MemoryDescriptorList);
    MiFlushEntireTbDueToAttributeChange(v31, (_BYTE *)v14);
  }
  MappedSystemVa = 0i64;
  MappingVa = 0i64;
  if( (v15 & 2) != 0
    && (unsigned int)v9 > 1
    && (MdlFlags = MemoryDescriptorList->MdlFlags, (MdlFlags & 0x4000) != 0)
    && ((MdlFlags & 5) == 0 ? (MappedSystemVa = MmMapLockedPagesSpecifyCache(
                                                  MemoryDescriptorList,
                                                  0,
                                                  MmCached,
                                                  0i64,
                                                  0,
                                                  0xC0000010)) : (MappedSystemVa = MemoryDescriptorList->MappedSystemVa),
        (MappingVa = MappedSystemVa) != 0i64) )
  {
    v29 = (VOID *)(v13 & 0xFFFFFFFFFFFFFFF8ui64);
    if( (v15 & 1) != 0 && !*(_QWORD *)(v5 + 56) )
    {
      result = MiGetSectionStrongImageReference(v5);
      if( (int)result < 0 )
        return result;
    }
    v30 = (unsigned int)((_DWORD)v9 << 12);
    v18 = (__int64)CallingProcess;
    LODWORD(BugCheckOnFailure) = v16 != 0 ? 2 : 0;
    if( (int)SeValidateImageData(v29, MappingVa, v30, *(_QWORD *)(a1 + 96), BugCheckOnFailure, CallingProcess) < 0 )
    {
      MappedSystemVa = 0i64;
      MappingVa = 0i64;
    }
    else
    {
      MappedSystemVa = MappingVa;
    }
  }
  else
  {
    v18 = (__int64)CallingProcess;
  }
  if( v6 >= v10 )
    return v38;
  v19 = BugCheckParameter2;
  v20 = 0i64;
  while( 1 )
  {
    PteBase = MmGetPteBase();
    v22 = (char *)MmGetPfnDb() + 48 * *v6;
    v15 ^= ((unsigned __int8)v15 ^ (unsigned __int8)(2 * v15)) & 8;
    if( v22 == (char *)qword_140C4EAB0 )
      goto LABEL_22;
    if( MappedSystemVa )
    {
      MiMarkPfnVerified((UINT64)v22, v37);
LABEL_30:
      PteBase = MmGetPteBase();
      goto LABEL_17;
    }
    if( (v15 & 2) == 0 )
      goto LABEL_17;
    v27 = MiValidateImagePfn(v19, *(_QWORD *)(a1 + 96), v18, 0xFFFFFFFF, BugCheckOnFailure, v36, *v6, 0);
    if( v27 >= 0 )
      goto LABEL_30;
    if( v27 == -1073741670 )
      break;
    v38 = -1073740748;
    if( (v15 & 1) == 0 || (MiFlags & 0x4000) == 0 )
      goto LABEL_30;
    PteBase = MmGetPteBase();
    if( (*(_DWORD *)(a1 + 192) & 0x10000) != 0 )
      v15 |= 8u;
LABEL_17:
    if( (v15 & 8) == 0 )
      goto LABEL_22;
    if( (MemoryDescriptorList->MdlFlags & 1) != 0 )
    {
      v23 = (unsigned __int64)MemoryDescriptorList->MappedSystemVa + 4096 * (v20 >> 3);
      v24 = (INT64 *)((char *)PteBase + ((v23 >> 9) & 0x7FFFFFFFF8i64));
      v25 = MI_READ_PTE_LOCK_FREE((INT64)v24);
      if( (v25 & 0x42) == 0 )
      {
        *v24 = v25 | 0x842;
        if( (MiFlags & 0x100) == 0 && (MiFlags & 0x200) == 0 )
          KeFlushSingleTb(v23, 0i64, 1i64);
      }
    }
    else
    {
      v23 = 0i64;
    }
    if( (int)MiRelocateImagePfn(BugCheckParameter2, v23, *(_DWORD *)(a1 + 188), *v6, 0i64, Priority, 2) < 0 )
      break;
    v19 = BugCheckParameter2;
LABEL_22:
    *(_QWORD *)(a1 + 96) += 4096i64;
    ++v6;
    ++*(_DWORD *)(a1 + 188);
    v20 += 8i64;
    if( v6 >= v10 )
      return v38;
    MappedSystemVa = MappingVa;
    v18 = (__int64)CallingProcess;
  }
  *(_DWORD *)(a1 + 80) = -1073741670;
  return v38;
}

Referenced by: