MiMapPageInHyperSpaceWorker

NTSTATUS __stdcall MiMapPageInHyperSpaceWorker(UINT64 PageFrameIndex, UINT8 *OldIrql, UINT64 Flags){
  int v3; 
  int v4; 
  int v6; 
  UINT64 ValidPte; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v9; 
  unsigned __int64 UltraMapping; 
  _MMPTE *PteBase; 
  unsigned __int64 v12; 
  UINT64 *v13; 
  BOOL v14; 
  UINT8 CurrentIrql; 
  v3 = Flags;
  v4 = 4;
  if( (v3 & 0x20000000) != 0 )
    v4 = 1;
  if( (v3 & 0x40000000) != 0 )
  {
    v6 = v3 & 3;
    if( v6 == 2 )
    {
      v4 |= 0x2000000u;
LABEL_17:
      v4 |= 0x18u;
      goto LABEL_8;
    }
  }
  else
  {
    v6 = *((unsigned __int8 *)MmGetPfnDb() + 48 * PageFrameIndex + 34) >> 6;
  }
  if( v6 && v6 != 3 )
  {
    if( v6 != 2 )
      goto LABEL_8;
    goto LABEL_17;
  }
  v4 |= 8u;
LABEL_8:
  ValidPte = MiMakeValidPte(0i64, PageFrameIndex, v4 | 0xA0000000);
  if( OldIrql )
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    *OldIrql = CurrentIrql;
  }
  CurrentPrcb = KeGetCurrentPrcb();
  v9 = *((_QWORD *)CurrentPrcb + 4095);
  if( v9 )
  {
    UltraMapping = MiGetUltraMapping((unsigned __int64 *)(v9 + 12448), 3u, 1i64, 0);
    PteBase = MmGetPteBase();
    LODWORD(v12) = UltraMapping;
    v13 = (UINT64 *)((char *)PteBase + ((UltraMapping >> 9) & 0x7FFFFFFFF8i64));
    *(_QWORD *)(v9 + 12344) = v13;
    if( UltraMapping )
      goto LABEL_12;
  }
  else
  {
    PteBase = MmGetPteBase();
  }
  v12 = (*((_QWORD *)CurrentPrcb + 4160) & 0xFFFFFFFFFFFFF000ui64)
      + ((*((_QWORD *)CurrentPrcb + 4160) & 0xFFFi64) << 12);
  v13 = (UINT64 *)((char *)PteBase + ((v12 >> 9) & 0x7FFFFFFFF8i64));
LABEL_12:
  v14 = MiPteInShadowRange((UINT64)v13);
  if( v3 >= 0 )
  {
    if( v14 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (ValidPte & 1) != 0 )
      goto LABEL_27;
  }
  else if( v14 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (ValidPte & 1) != 0 )
  {
LABEL_27:
    ValidPte |= 0x8000000000000000ui64;
  }
  *v13 = ValidPte;
  return v12;
}

Referenced by: