MiCreatePagingFileMap
NTSTATUS __stdcall MiCreatePagingFileMap(INT64 rcx0, INT16 a2){
int v2;
INT64 v3;
char v5;
unsigned __int64 v6;
__int64 v7;
unsigned __int64 v8;
int v9;
_ETHREAD *CurrentThread;
char v11;
ULONG_PTR **v12;
ULONG_PTR *v13;
int v14;
UINT64 v15;
unsigned int *v16;
unsigned int *v17;
UINT64 LargeZeroPages;
__int64 PfnLink;
__int64 v20;
unsigned __int64 v21;
unsigned __int64 v22;
INT64 v23;
INT64 v24;
INT64 v25;
INT64 v26;
__int16 v27;
int v28;
int v29;
__int16 v30;
__int16 v31;
__int64 v32;
unsigned __int64 v33;
INT64 v34;
INT64 i;
unsigned __int64 v36;
unsigned __int64 v37;
__int16 v38;
unsigned __int8 v39;
void *v40;
__int64 v41;
INT64 v42;
char *v43;
int v44;
__int64 v45;
INT64 v46;
unsigned __int64 v47;
INT64 v48;
void *v49;
INT64 v50;
__int64 v51;
UINT64 ProtectionMask;
UINT64 ProtectionMaska;
unsigned __int64 v54;
__int64 v55;
__int64 v56;
INT64 v57;
unsigned __int64 v58;
__int64 v59;
INT64 v60;
__int64 v61;
INT64 v62;
INT64 v63;
__int64 v64[14];
unsigned int v66;
__int64 v67;
char v68;
char v69;
unsigned __int64 v70;
PVOID P;
v2 = *(_DWORD *)(rcx0 + 16);
v3 = rcx0;
memset(v64, 0, 32);
if( (v2 & 0x1000000) != 0 )
return -1073741792;
v5 = *(_BYTE *)(rcx0 + 192);
v69 = v5;
if( v5 )
{
if( (v2 & 0x2BF7FFFF) != 0
|| (v2 & 0x4000000) == 0
|| (v2 & 0x8000000) != 0
|| (v2 & 0x80080000) == -2146959360
|| (v2 & 0x50000000) == 1342177280 )
{
return -1073741811;
}
if( (*(_DWORD *)(rcx0 + 28) & 7) != 4 )
return -1073741755;
if( (*(_DWORD *)(rcx0 + 32) & 7) != 4 )
return -1073741811;
}
else
{
if( v2 >= 0 )
goto LABEL_18;
if( (v2 & 0x8000000) == 0 )
return -1073741580;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, *(_BYTE *)(rcx0 + 72)) )
return -1073741727;
LABEL_18:
v6 = *(_QWORD *)(v3 + 152);
v7 = 1i64;
if( v5 )
{
if( v6 )
return -1073741582;
v8 = 1i64;
v9 = v2 & 0x8000000;
}
else
{
if( !v6 )
return -1073741582;
v9 = v2 & 0x8000000;
if( v6 > (-(__int64)((v2 & 0x8000000) != 0) & 0xFFFFF001000ui64) - 4096 )
return -1073741760;
v8 = (v6 + 4095) >> 12;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v11 = 0;
v12 = *(ULONG_PTR ***)(v3 + 176);
v55 = 0i64;
v68 = 0;
v59 = (__int64)CurrentThread;
if( v12 )
v13 = *v12;
else
v13 = &MiSystemPartition;
if( !v9 )
goto LABEL_49;
if( (v2 & 0x80000) != 0 && (v8 & 0xF) != 0 || v2 < 0 && (v8 & 0x1FF) != 0 )
return -1073741582;
if( !(unsigned int)MiChargeCommit((_MI_PARTITION *)v13, v8, 0i64) )
return -1073741523;
if( v2 >= 0 )
{
v7 = 1i64;
}
else
{
if( !(unsigned int)MiChargeResident(v13, v8, 0i64) )
{
LABEL_104:
if( v9 )
{
MiFreeLargeZeroPages((UINT64)v13, (CHAR *)v64, 0i64);
if( v11 )
MiReturnResident((INT64)v13, v8);
MiReturnCommit((_MI_PARTITION *)v13, v8);
}
return -1073741670;
}
v14 = *(_DWORD *)(v3 + 172);
v68 = 1;
if( v14 )
v15 = (unsigned int)(v14 - 1);
else
v15 = *((unsigned int *)*(&KiProcessorBlock + *((unsigned int *)CurrentThread + 147)) + 8133);
v16 = (unsigned int *)(qword_140C4DBD8 + 4i64 * (unsigned int)v15 * (unsigned __int16)KeNumberNodes);
v17 = &v16[(unsigned __int16)KeNumberNodes];
LODWORD(ProtectionMask) = *(_DWORD *)(v3 + 32);
LargeZeroPages = MiAllocateLargeZeroPages((INT64)v13, v8, 0x200ui64, v15, ProtectionMask, (INT64)v64, 0);
if( LargeZeroPages != v8 )
{
do
{
if( ++v16 == v17 )
break;
LODWORD(ProtectionMaska) = *(_DWORD *)(v3 + 32);
LargeZeroPages += MiAllocateLargeZeroPages(
(INT64)v13,
v8 - LargeZeroPages,
0x200ui64,
*v16,
ProtectionMaska,
(INT64)v64,
0);
}
while( LargeZeroPages != v8 );
if( LargeZeroPages != v8 )
{
LABEL_103:
v11 = v68;
goto LABEL_104;
}
}
PfnLink = v64[0];
v7 = 1i64;
if( v64[0] )
{
v20 = 0i64;
do
{
v20 += v7;
PfnLink = MiGetPfnLink(PfnLink);
}
while( PfnLink );
v55 = v20;
v3 = rcx0;
}
}
LABEL_49:
P = 0i64;
if( (v2 & 0x88000000) == 0x8000000 )
{
v54 = v8;
v21 = v7;
}
else
{
v22 = (unsigned __int64)(((v2 >> 31) & 0x100000u) + 0x100000) >> 3;
v54 = v22;
v21 = v8 / v22;
if( v8 % v22 )
v21 += v7;
}
LODWORD(v23) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v63 = v23;
v24 = v23;
if( !v23 )
goto LABEL_103;
LODWORD(v25) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
v60 = v25;
v26 = v25;
if( !v25 )
goto LABEL_94;
*(_QWORD *)(v25 + 72) = 0i64;
v27 = (*(_WORD *)(v24 + 60) ^ *(_WORD *)v13) & 0x3FF;
*(_DWORD *)(v24 + 96) = v21;
*(_WORD *)(v24 + 60) ^= v27;
*(_QWORD *)(v24 + 16) = v24 + 8;
*(_QWORD *)(v24 + 8) = v24 + 8;
v28 = *(_DWORD *)(v24 + 56);
*(_QWORD *)(v24 + 112) = 1i64;
*(_QWORD *)(v24 + 24) = 1i64;
*(_QWORD *)(v24 + 48) = 1i64;
*(_QWORD *)v24 = v25;
if( (v2 & 0x200000) != 0 )
{
v28 |= 0x40u;
*(_DWORD *)(v24 + 56) = v28;
}
if( (v2 & 0x4000000) != 0 )
{
v28 |= 0x1000u;
*(_DWORD *)(v24 + 56) = v28;
}
if( v9 )
{
v28 |= 0x2000u;
*(_DWORD *)(v24 + 56) = v28;
}
if( (v2 & 0x80000) != 0 )
{
v28 |= 0x80000000;
*(_DWORD *)(v24 + 56) = v28;
}
v29 = *(_DWORD *)(v3 + 172);
*(_QWORD *)(v24 + 104) = 0i64;
*(_DWORD *)(v24 + 56) = v28 ^ (v28 ^ (v29 << 20)) & 0x3F00000;
memset(v26, 0i64);
if( (v2 & 0x10000000) != 0 )
{
v30 = 0x8000;
LABEL_67:
*(_WORD *)(v26 + 12) |= v30;
goto LABEL_68;
}
if( (v2 & 0x40000000) != 0 )
{
v30 = 0x4000;
goto LABEL_67;
}
LABEL_68:
*(_BYTE *)(v26 + 14) ^= (*(_BYTE *)(v26 + 14) ^ (2 * *(_BYTE *)(v3 + 32))) & 0x3E;
*(_DWORD *)(v26 + 48) = *(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1088i64);
*(_QWORD *)(v26 + 24) = v8 << 12;
v31 = (*(_WORD *)(v26 + 12) ^ WORD2(v8)) & 0x3FF;
*(_QWORD *)v26 = v24;
*(_WORD *)(v26 + 12) ^= v31;
*(_DWORD *)(v26 + 8) = v8;
if( v69 && (int)MiAllocateAweInfo() < 0 )
{
LABEL_94:
v47 = 0i64;
if( v21 )
{
v66 = v2 & 0x88000000;
v48 = v24 + 136;
do
{
v49 = *(void **)v48;
if( !*(_QWORD *)v48 )
break;
if( v66 == -2013265920 )
{
MmReturnChargesToLockPagedPool(v49, 8i64 * *(unsigned int *)(v48 + 36));
v49 = *(void **)v48;
}
ExFreePoolWithTag(v49, 0);
v48 += 88i64;
++v47;
}
while( v47 < v21 );
v26 = v60;
}
ExFreePoolWithTag((PVOID)v24, 0);
if( v26 )
ExFreePoolWithTag((PVOID)v26, 0);
goto LABEL_103;
}
v70 = v8;
v32 = 0i64;
v57 = v24 + 128;
v33 = 0i64;
v56 = 0i64;
v58 = 0i64;
v34 = v24 + 128;
for( i = v24 + 128; v33 < v21; v58 = v33 )
{
i = v34;
v36 = v54;
v37 = *(_QWORD *)(v34 + 80) & 0xFFFFFFFFFFFFFFF8ui64 | 1;
*(_QWORD *)v34 = v24;
*(_QWORD *)(v34 + 80) = v37;
v38 = *(_WORD *)(v3 + 32);
v62 = v34;
if( v70 <= v54 )
v36 = v70;
*(_DWORD *)(v34 + 36) = v32;
v39 = *(_WORD *)(v34 + 32) & 1;
v70 -= v36;
*(_DWORD *)(v34 + 44) = v36;
*(_WORD *)(v34 + 32) = (WORD2(v32) << 6) | (v39 | (unsigned __int8)(2 * v38)) & 0x3F;
v61 = 8 * v36;
if( v9 )
{
LODWORD(v40) = MiAllocatePool((struct _SLIST_ENTRY *)0x112);
P = v40;
if( !v40 )
goto LABEL_94;
if( v2 < 0 )
{
if( !(unsigned int)MmObtainChargesToLockPagedPool(v40, v61) )
{
ExFreePoolWithTag(P, 0);
goto LABEL_94;
}
v40 = P;
}
v34 = v57;
i = v62;
v33 = v58;
v32 = v56;
LODWORD(v36) = *(_DWORD *)(v57 + 44);
*(_QWORD *)(v57 + 8) = v40;
}
v34 += 88i64;
v32 += (unsigned int)v36;
v57 = v34;
++v33;
v56 = v32;
*(_QWORD *)(i + 16) = v34;
}
*(_QWORD *)(i + 16) = 0i64;
*(_QWORD *)(v26 + 64) = P;
if( v9 )
{
--*(_WORD *)(v59 + 486);
ExAcquirePushLockExclusiveEx(v26 + 40, 0i64);
MiUpdateControlAreaCommitCount(v24, v8);
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)(v26 + 40), 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((volatile INT64 *)(v26 + 40));
KeAbPostRelease((PVOID)(v26 + 40));
KiLeaveGuardedRegionUnsafe(v59);
if( v2 >= 0 )
{
MiInitializePrototypePtes(*(_QWORD *)(v24 + 136), v8, (unsigned __int16 *)(v24 + 128), 1);
MiUpdateSystemProtoPtesTree((RTL_BALANCED_NODE *)(v24 + 184), 1i64);
}
else
{
*(_WORD *)(v26 + 12) |= 0x1000u;
*(_DWORD *)(v24 + 92) |= 0x10000u;
if( v21 )
{
v41 = v55;
v42 = v24 + 176;
do
{
v43 = *(char **)(v42 - 40);
MmLockPreChargedPagedPool(v43, 8i64 * *(unsigned int *)(v42 - 4));
v44 = *(_DWORD *)v42 & 0x3FFFFFFF | 0x40000000;
*(_DWORD *)v42 = v44;
if( v41 )
{
--v41;
*(_DWORD *)v42 = v44 & 0x3FFFFFFF | 0x80000000;
}
memset(v43, 0, 8i64 * *(unsigned int *)(v42 - 4));
MiUpdateSystemProtoPtesTree((RTL_BALANCED_NODE *)(v42 + 8), 1i64);
v67 = 0i64;
if( *(_DWORD *)(v42 - 4) )
{
do
{
v45 = 0i64;
while( 1 )
{
v46 = v64[v45];
if( v46 )
break;
if( (unsigned __int64)++v45 >= 4 )
goto LABEL_110;
}
v50 = MiGetPfnLink(v46);
v64[v45] = v50;
LABEL_110:
v51 = MiLargePageSizes[(unsigned int)v45];
MiUpdateLargePageSectionPfns(v46, (INT64)v43, *(unsigned int *)(v3 + 32));
v43 += 8 * v51;
v67 += v51;
}
while( v67 != *(_DWORD *)(v42 - 4) );
}
v42 += 88i64;
--v21;
}
while( v21 );
v24 = v63;
v26 = v60;
}
}
}
*(_QWORD *)(v3 + 64) = v24;
_InterlockedAdd64((volatile signed __int64 *)v13 + 170, 1ui64);
*(_DWORD *)v3 |= 4u;
*(_QWORD *)(v3 + 128) = _InterlockedCompareExchange64((volatile signed __int64 *)(v26 + 24), -1i64, -1i64);
return 0;
}Referenced by:
MiCreateSection