MiMapLockedPagesInUserSpace

NTSTATUS __stdcall MiMapLockedPagesInUserSpace(
        MDL *MemoryDescriptorList,
        PVOID StartingVa,
        MEMORY_CACHING_TYPE CacheType,
        PVOID BaseVa,
        UINT64 Priority){
  UINT64 *v6; 
  unsigned __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  MDL *v10; 
  __int64 v11; 
  UINT64 UserReservationHighestAddress; 
  UINT64 v13; 
  unsigned __int64 v14; 
  NTSTATUS v15; 
  char *v16; 
  NTSTATUS inserted; 
  char *v18; 
  UINT64 *p_Size; 
  UINT64 v20; 
  char *v21; 
  __int64 v22; 
  int v23; 
  INT64 v25; 
  _RTL_BALANCED_NODE **v26; 
  int v27; 
  unsigned __int64 v28; 
  unsigned __int64 v29; 
  _MMPFN *PfnDb; 
  UINT64 v31; 
  UINT64 *HINTHonored; 
  PVOID *StartingAddress; 
  ULONG_PTR v34; 
  MDL *v35; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v37; 
  __int64 v38; 
  char *StartVaa; 
  if( ((unsigned __int16)BaseVa & 0xFFF) != 0 )
    RtlRaiseStatus(-1073741503);
  v6 = (UINT64 *)&MemoryDescriptorList[1];
  v35 = MemoryDescriptorList + 1;
  v7 = (((unsigned __int16)StartingVa & 0xFFF) + 4095i64 + (unsigned __int64)MemoryDescriptorList->ByteCount) >> 12;
  LODWORD(v8) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
  v38 = v8;
  v9 = v8;
  if( !v8 )
    RtlRaiseStatus(-1073741670);
  *(_QWORD *)(v8 + 40) = 0i64;
  v10 = 0i64;
  *(_QWORD *)(v8 + 16) = -2i64;
  *(_DWORD *)(v8 + 48) = *(_DWORD *)(v8 + 48) & 0xFFFFF01F | ((((((int)Priority >> 31) & 0xFD) + 4) & 0x1F) << 7) | 0x8100010;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = *((_QWORD *)CurrentThread + 23);
  v34 = v11;
  LOCK_ADDRESS_SPACE((__int64)CurrentThread, v11);
  if( (*(_DWORD *)(v11 + 1124) & 0x20) != 0 )
  {
    inserted = -1073741558;
    goto LABEL_20;
  }
  UserReservationHighestAddress = MiGetUserReservationHighestAddress(v11, 0i64);
  v14 = (unsigned __int64)BaseVa;
  if( !BaseVa )
  {
    LODWORD(StartingAddress) = 0;
    LODWORD(HINTHonored) = (((int)Priority >> 31) & 0xFFFFFFFD) + 4;
    v15 = MiSelectUserAddress(
            0i64,
            v13,
            UserReservationHighestAddress,
            v7 << 12,
            0x10000ui64,
            0i64,
            HINTHonored,
            StartingAddress);
    v16 = 0i64;
    inserted = v15;
    if( v15 >= 0 )
    {
      v14 = (unsigned __int64)BaseVa;
      goto LABEL_7;
    }
LABEL_20:
    v22 = v34;
    goto LABEL_27;
  }
  MiIsVaRangeAvailable((_EPROCESS *)v11, BaseVa, v7 << 12, 0i64);
  if( !v27 )
  {
    inserted = -1073741800;
    goto LABEL_20;
  }
LABEL_7:
  StartVaa = v16;
  v18 = v16;
  *(_DWORD *)(v9 + 24) = v14 >> 12;
  *(_BYTE *)(v9 + 32) = v14 >> 44;
  v37 = v14 + (v7 << 12) - 1;
  *(_DWORD *)(v9 + 28) = v37 >> 12;
  *(_BYTE *)(v9 + 33) = v37 >> 12 >> 32;
  if( v7 )
  {
    p_Size = v6;
    do
    {
      v20 = *p_Size;
      if( (unsigned int)MiIsPfn(*p_Size) )
      {
        v21 = (char *)MmGetPfnDb() + 48 * v20;
        inserted = MiLegitimatePageForDriversToMap((INT64)v21);
        if( inserted < 0 || !(unsigned int)MiDoubleLockMdlPage((INT64)v21) )
          goto LABEL_20;
        v18 = StartVaa;
      }
      else
      {
        v25 = MiSanitizePage(v20);
        inserted = MiReferenceIoPages(1ui64, v25, 1i64, (unsigned int)CacheType, v26, v26);
        if( inserted < 0 )
          goto LABEL_20;
      }
      ++v18;
      v10 = v35;
      StartVaa = v18;
      p_Size = (UINT64 *)&v35->Size;
      v35 = (MDL *)((char *)v35 + 8);
    }
    while( (unsigned __int64)v18 < v7 );
  }
  v22 = v34;
  inserted = MiInsertVadCharges(v9, v34);
  if( inserted < 0 )
  {
LABEL_27:
    UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, v22);
    if( v10 )
    {
      v28 = 1i64;
      v29 = (unsigned __int64)((char *)v10 - (char *)v6 + 8) >> 3;
      if( v6 > (UINT64 *)v10 )
        v29 = 0i64;
      if( v29 )
      {
        PfnDb = MmGetPfnDb();
        do
        {
          v31 = *v6;
          if( (unsigned int)MiIsPfn(*v6) )
            MiDoubleUnlockMdlPage((UINT64)PfnDb + 48 * v31);
          else
            MiDereferenceIoPages(1i64, v31, 1i64);
          ++v6;
          ++v28;
        }
        while( v28 <= v29 );
        v9 = v38;
      }
    }
    ExFreePoolWithTag((PVOID)v9, 0);
    RtlRaiseStatus(inserted);
  }
  MiLockVad((__int64)CurrentThread, v9);
  LODWORD(HINTHonored) = Priority;
  MiMapLockedPagesInUserSpaceHelper((VOID *)v14, v6, 0i64, CacheType, v7, (_MMVAD *)v9, (UINT64)HINTHonored);
  UNLOCK_ADDRESS_SPACE_UNORDERED((__int64)CurrentThread, v34);
  MiReferenceVad(v9);
  v23 = 2;
  if( (((int)Priority >> 31) & 0xFFFFFFFD) != -3 )
    v23 = 4;
  if( !MiAddSecureEntry(v9, v14, v37, v23, 0) )
  {
    MiDeleteVad((_MMVAD *)v9, 0i64);
    RtlRaiseStatus(-1073741670);
  }
  MiUnlockAndDereferenceVad((PVOID)v9);
  return v14 + MemoryDescriptorList->ByteOffset;
}

Referenced by: