MiReserveDriverPtes

MMPTE *__stdcall MiReserveDriverPtes(UINT64 SessionImage, UINT64 ExactPtes){
  unsigned int v2; 
  _ETHREAD *CurrentThread; 
  __int64 v4; 
  unsigned int v6; 
  MMPTE *v7; 
  struct _RTL_BITMAP *i; 
  CHAR v9; 
  ULONG ClearBitsAndSet; 
  INT64 v11; 
  unsigned int v13; 
  RTL_BITMAP *v14; 
  RTL_BITMAP *v15; 
  void *v16; 
  CHAR v17; 
  INT64 v18; 
  MMPTE *PteAddress; 
  int v20; 
  RTL_BITMAP *v21; 
  INT64 v22; 
  UINT64 v23; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = v2;
  v6 = (unsigned int)(SessionImage + 15) >> 4;
  MiLockDriverMappings((__int64)CurrentThread);
  v7 = 0i64;
  if( !ExactPtes )
  {
    for( i = *(struct _RTL_BITMAP **)&MiState[8 * v4 + 1136]; i; i = *(struct _RTL_BITMAP **)&i->SizeOfBitMap )
    {
      if( (*(&i[2].SizeOfBitMap + 1) & 1) == 0 && i[1].SizeOfBitMap >= v6 )
      {
        ClearBitsAndSet = RtlFindClearBitsAndSet(i + 1, v6, i[2].SizeOfBitMap);
        if( ClearBitsAndSet != -1 )
        {
          v7 = (MMPTE *)&i->Buffer[32 * (unsigned __int64)ClearBitsAndSet];
          i[2].SizeOfBitMap = v6 + ClearBitsAndSet;
          goto LABEL_8;
        }
      }
    }
  }
  v13 = (unsigned __int8)ExGenRandom(1i64);
  LODWORD(v14) = MiAllocatePool((struct _SLIST_ENTRY *)(*(_DWORD *)InitializationPhase != 0 ? 256i64 : 64i64));
  v15 = v14;
  if( !v14 )
  {
LABEL_8:
    MiUnlockDriverMappings((INT64)CurrentThread, v9, v11);
    return v7;
  }
  v16 = (void *)MiObtainSystemVa(((16 * (v6 + v13) + 511) & 0xFFFFFE00) >> 9, 12 - (unsigned int)((_DWORD)v4 != 0));
  v23 = (UINT64)v16;
  if( !v16 )
    goto LABEL_18;
  PteAddress = MiGetPteAddress(v16);
  if( !(_DWORD)v4 )
  {
    LOBYTE(v20) = MiMakeZeroedPageTables(PteAddress);
    if( !v20 )
    {
      MiReturnSystemVa(
        v23,
        (__int64)(((_QWORD)PteAddress << 25)
                - ((_QWORD)MmGetPteBase() << 25)
                + ((unsigned __int64)((16 * (v6 + v13) + 511) & 0xFFFFFE00) << 28)) >> 16,
        12 - (unsigned int)((_DWORD)v4 != 0));
LABEL_18:
      MiUnlockDriverMappings((INT64)CurrentThread, v17, v18);
      ExFreePoolWithTag(v15, 0);
      return 0i64;
    }
  }
  memset((INT64)&v15[2].Buffer, 0i64);
  v21 = v15 + 1;
  v15[1].SizeOfBitMap = ((16 * (v6 + v13) + 511) & 0xFFFFFE00) >> 4;
  v15[1].Buffer = (unsigned int *)&v15[2].Buffer;
  if( ExactPtes )
  {
    v13 = 0;
    RtlSetAllBits(v21);
    LODWORD(v7) = 2;
  }
  else
  {
    RtlSetBits(v21, v13, v6);
  }
  *(&v15[2].SizeOfBitMap + 1) = (unsigned int)v7;
  v15->Buffer = (unsigned int *)PteAddress;
  v15[2].SizeOfBitMap = v6 + v13;
  *(_QWORD *)&v15->SizeOfBitMap = *(_QWORD *)&MiState[8 * v4 + 1136];
  *(_QWORD *)&MiState[8 * v4 + 1136] = v15;
  MiUnlockDriverMappings((INT64)CurrentThread, (CHAR)MiState, v22);
  return(MMPTE *)((char *)PteAddress + 128 * (unsigned __int64)v13);
}

Referenced by: