MiProbeAndLockPrepare
INT64 __fastcall MiProbeAndLockPrepare(INT64 a1, INT64 a2, UINT64 a3, UINT64 a4, CHAR a5, INT64 a6, INT64 a7){
int v8;
UINT64 v10;
__int64 v11;
_MMPTE *PteBase;
unsigned __int64 v13;
UINT64 v14;
__int16 v15;
__int16 v16;
__int16 v17;
__int64 v18;
UINT64 v19;
int v20;
int *v21;
_QWORD *v22;
INT64 *SessionVm;
unsigned int v24;
unsigned __int8 v25;
LONG *v26;
UINT8 v27;
int v28;
unsigned __int8 CurrentIrql;
int v30;
char v31;
CHAR *AnyMultiplexedVm;
unsigned __int64 v34;
unsigned __int64 v35;
unsigned int v36;
CHAR *v37;
int v38;
__int64 v39;
__int64 v40;
__int64 v41;
int v42;
UINT64 v43;
unsigned __int64 v44;
unsigned int v45;
CHAR *v46;
int v47;
INT64 v48;
INT64 v49;
v8 = a6;
v10 = a3 + (unsigned int)a4;
*(_QWORD *)(a1 + 72) = KeGetCurrentThread();
LODWORD(v49) = 0;
*(_QWORD *)(a1 + 56) = a2;
*(_DWORD *)(a1 + 88) = v8;
*(_QWORD *)a1 = a3;
*(_QWORD *)(a1 + 8) = v10;
if( a5 && (v10 > 0x7FFFFFFF0000i64 || a3 >= v10) )
{
++dword_140C4E4B8;
return 3221225477i64;
}
v11 = *(unsigned int *)(a2 + 40);
*(_QWORD *)(a1 + 48) = a2 + 48;
PteBase = MmGetPteBase();
v13 = ((a3 & 0xFFF) + v11 + 4095) >> 12;
v14 = v10 - 1;
*(_QWORD *)(a1 + 16) = (char *)PteBase + ((a3 >> 9) & 0x7FFFFFFFF8i64);
*(_QWORD *)(a1 + 24) = (char *)PteBase + ((v14 >> 9) & 0x7FFFFFFFF8i64);
*(_QWORD *)(a1 + 136) = 0xFFFFFFFFFi64;
v15 = *(_WORD *)(a2 + 10);
v16 = v15 | 0x80;
v17 = v15 & 0xFF7F;
if( v8 )
v17 = v16;
*(_WORD *)(a2 + 10) = v17 | 2;
*(_QWORD *)(a1 + 120) = 0i64;
*(_QWORD *)(a1 + 104) = 0i64;
*(_QWORD *)(a1 + 112) = 0i64;
if( *(_QWORD *)a1 >= 0x7FFFFFFF0000ui64 )
{
*(_QWORD *)(a1 + 80) = 0i64;
*(_QWORD *)(a2 + 16) = 0i64;
}
else
{
v18 = *(_QWORD *)(*(_QWORD *)(a1 + 72) + 184i64);
*(_QWORD *)(a1 + 80) = v18;
*(_QWORD *)(a2 + 16) = v18;
if( v8 == 3 )
{
v39 = MiObtainReferencedVadEx(*(_QWORD *)a1, 0, &v49);
v40 = v39;
if( !v39 )
return(unsigned int)v49;
if( (unsigned int)MiVadPureReserve(v39)
|| (v41 = *(unsigned int *)(v40 + 52),
LODWORD(v41) = v41 & 0x7FFFFFFF,
(v41 | ((unsigned __int64)*(unsigned __int8 *)(v40 + 34) << 31)) >= 0x7FFFFFFFDi64)
|| (v42 = *(_DWORD *)(v40 + 48), (v42 & 0x70) == 16)
|| (v42 & 0x100000) == 0 && (v42 & 0x70) != 32 )
{
MiUnlockAndDereferenceVad((PVOID)v40);
return 3221225477i64;
}
v43 = (*(unsigned int *)(v40 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v40 + 32) << 32)) << 12;
if( a3 < v43
|| (v44 = ((*(unsigned int *)(v40 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v40 + 33) << 32)) << 12) | 0xFFF,
a3 > v44)
|| v14 < v43
|| v14 > v44 )
{
MiUnlockAndDereferenceVad((PVOID)v40);
return 3221225496i64;
}
LODWORD(v49) = MiChargeFullProcessCommitment(*(_QWORD *)(a1 + 80), v13);
v45 = v49;
if( (int)v49 < 0 )
{
MiUnlockAndDereferenceVad((PVOID)v40);
return v45;
}
*(_QWORD *)(a1 + 120) = v40;
*(_QWORD *)(a1 + 112) = v13;
}
if( (_DWORD)a7 )
_InterlockedExchangeAdd64((volatile signed __int64 *)(*(_QWORD *)(a1 + 80) + 1280i64), v13);
}
v19 = *(_QWORD *)a1;
*(_QWORD *)(a1 + 32) = 0i64;
if( v19 >= 0xFFFF800000000000ui64 )
v20 = *((unsigned __int8 *)&antNameB + ((v19 >> 39) & 0x1FF) - 256);
else
v20 = 0;
if( v19 >= 0x7FFFFFFF0000i64 )
{
if( v20 == 1 )
{
v21 = (int *)(a1 + 64);
*(_DWORD *)(a1 + 64) = *(_DWORD *)(a1 + 64) & 0xFFFFFFF0 | 8;
v22 = (_QWORD *)(a1 + 96);
SessionVm = (INT64 *)MiGetSessionVm();
*(_QWORD *)(a1 + 96) = SessionVm;
goto LABEL_15;
}
if( v20 == 6 )
{
v21 = (int *)(a1 + 64);
v22 = (_QWORD *)(a1 + 96);
SessionVm = &qword_140C4EFC0;
v24 = *(_DWORD *)(a1 + 64) & 0xFFFFFFF0 | 3;
*(_QWORD *)(a1 + 96) = &qword_140C4EFC0;
}
else
{
if( v20 == 8 )
{
AnyMultiplexedVm = MiGetAnyMultiplexedVm(0i64);
v21 = (int *)(a1 + 64);
v24 = *(_DWORD *)(a1 + 64) & 0xFFFFFFF0 | 2;
}
else
{
if( v20 != 5 && v20 != 15 )
{
v22 = (_QWORD *)(a1 + 96);
v48 = a1 + 96;
v21 = (int *)(a1 + 64);
if( v20 == 12 )
{
SessionVm = (INT64 *)MiGetAnyMultiplexedVm(1i64);
v36 = *v21 & 0xFFFFFFF6;
*v22 = SessionVm;
v24 = v36 | 6;
*v21 = v24;
goto LABEL_16;
}
v48 = a1 + 96;
if( v20 == 14 )
{
v37 = MiGetAnyMultiplexedVm(4i64);
*v22 = v37;
v24 = v38 & 0xFFFFFFF0 | 7;
SessionVm = (INT64 *)v37;
*v21 = v24;
goto LABEL_16;
}
v46 = MiGetAnyMultiplexedVm(3i64);
*v22 = v46;
v24 = v47 & 0xFFFFFFF0 | 5;
SessionVm = (INT64 *)v46;
goto LABEL_14;
}
AnyMultiplexedVm = MiGetAnyMultiplexedVm(5i64);
v21 = (int *)(a1 + 64);
v24 = *(_DWORD *)(a1 + 64) & 0xFFFFFFF0 | 4;
}
v22 = (_QWORD *)(a1 + 96);
SessionVm = (INT64 *)AnyMultiplexedVm;
*(_QWORD *)(a1 + 96) = AnyMultiplexedVm;
}
}
else
{
v21 = (int *)(a1 + 64);
v22 = (_QWORD *)(a1 + 96);
SessionVm = (INT64 *)(*(_QWORD *)(a1 + 80) + 1664i64);
v24 = *(_DWORD *)(a1 + 64) & 0xFFFFFFF0 | 1;
*(_QWORD *)(a1 + 96) = SessionVm;
}
LABEL_14:
*v21 = v24;
LABEL_15:
v48 = (INT64)v22;
LABEL_16:
*v21 = v24 & 0xFFFFFFCF;
v25 = SessionVm[23] & 7;
if( v25 >= 6u )
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
}
else
{
if( v25 == 2 )
v26 = &dword_140C4F4C0;
else
v26 = (LONG *)(SessionVm + 24);
v27 = KeGetCurrentIrql();
__writecr8(2ui64);
_m_prefetchw(v26);
v28 = *v26 & 0x7FFFFFFF;
if( v28 != _InterlockedCompareExchange(v26, v28 + 1, v28) )
ExpWaitForSpinLockSharedAndAcquire((INT64 *)v26, v27);
if( v26[1] )
_InterlockedExchange(v26 + 1, 0);
CurrentIrql = v27;
v22 = (_QWORD *)v48;
}
v30 = *v21;
v31 = *v21 & 0xF;
*(_BYTE *)(a1 + 68) = CurrentIrql;
if( v31 == 1 && *(_QWORD *)(*(_QWORD *)(a1 + 80) + 1264i64) )
*v21 = v30 | 0x10;
if( v20 == 8 )
{
v34 = *(_QWORD *)(MiGetSystemCacheReverseMap(v19) + 24);
v35 = v34 & 0xFFFFFFFFFFFFFFFEui64;
if( (v34 & 1) == 0 )
v35 = v34;
*v22 = *(_QWORD *)(qword_140C4E388 + 8i64 * (*(_WORD *)(*(_QWORD *)v35 + 60i64) & 0x3FF)) + 7232i64;
}
return 0i64;
}Referenced by:
MiProbeAndLockPages
MmProbeAndLockSelectedPages
MmStoreProbeAndLockPages