MiGetUltraMapping

VOID __fastcall MiGetUltraMapping(_MI_ZERO_THREAD_CONTEXT *ThreadContext, INT64 LargePageIndex){
  __int64 v2; 
  char v3; 
  unsigned __int64 v4; 
  unsigned int v5; 
  char v6; 
  __int64 v7; 
  __int64 v9; 
  unsigned __int64 v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  UINT64 v13; 
  _MMPTE *PteBase; 
  unsigned __int64 Long; 
  int v16; 
  __int64 v17; 
  _XSTATE_CONFIGURATION *v18; 
  __int64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  int v23; 
  _MMPTE *PdpteBase; 
  UINT64 SetBitsAndClear; 
  UINT64 v26; 
  UINT64 v27; 
  __int64 v28; 
  __int64 v29; 
  INT64 *v30; 
  __int64 v31; 
  __int64 v32; 
  __int64 v33; 
  int v34; 
  unsigned __int64 v35; 
  unsigned __int64 v36; 
  unsigned __int64 *v37; 
  int v38; 
  unsigned __int64 v39; 
  int v40; 
  __int64 v41; 
  unsigned __int64 v42; 
  unsigned __int64 i; 
  _QWORD *v44; 
  __int64 v45; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  UINT64 v47; 
  _XSTATE_CONFIGURATION *v48; 
  unsigned __int64 *v49; 

  v4 = *(_QWORD *)ThreadContext;
  v5 = LargePageIndex;
  v6 = v3;
  v7 = v2;
  v9 = MiUltraMapSizes[(unsigned int)LargePageIndex];
  memset(&LockHandle, 0, sizeof(LockHandle));
  if( !v4 )
    goto LABEL_17;
  if( (_DWORD)LargePageIndex == 1 )
  {
    v10 = v9 << 9;
LABEL_5:
    v11 = v10 - 1;
    v12 = v2 << 12;
    if( (v2 << 12) + (v4 & (v10 - 1)) > v10 )
    {
      v4 = ~v11 & (v10 + v4 - 1);
      *(_QWORD *)ThreadContext = v4;
    }
    if( (v11 & v4) != 0 && (v3 & 2) == 0 )
    {
      *(_QWORD *)ThreadContext = v12 + v4;
      return;
    }
    v13 = (UINT64)MmGetPdeBase() + (((v4 - 1) >> 18) & 0x3FFFFFF8);
    PteBase = MmGetPteBase();
    v47 = v13;
    if( v5 <= 1 )
    {
      v41 = 2 - v5;
      do
      {
        v13 = (UINT64)PteBase + ((v13 >> 9) & 0x7FFFFFFFF8i64);
        --v41;
      }
      while( v41 );
      v47 = v13;
    }
    Long = ZeroPte.u.Long;
    LOBYTE(v16) = MiPteInShadowRange(v13);
    if( v16 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
      Long = v17 | ZeroPte.u.Long;
    *(_QWORD *)v47 = Long;
    if( (v6 & 2) != 0 )
    {
      if( v5 > 1 )
      {
        v39 = ZeroPte.u.Long;
        v49 = (unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + ((v47 >> 9) & 0x7FFFFFFFF8i64));
        LOBYTE(v40) = MiPteInShadowRange((UINT64)v49);
        if( v40 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
          v39 = ZeroPte.u.Long | 0x8000000000000000ui64;
        *v49 = v39;
      }
    }
    else if( v5 != 1 )
    {
      v18 = (_XSTATE_CONFIGURATION *)(v47 + 8);
      v48 = v18;
      if( ((unsigned __int16)v18 & 0xFFF) != 0 )
      {
        v19 = (_QWORD)MmGetPteBase() << 25;
        v20 = (((((_QWORD)v18 << 25) - v19) >> 16 << 25) - v19) >> 16;
        LODWORD(v21) = MiMakeValidPte(v18, *((_QWORD *)ThreadContext + 2), 3087007748i64);
        v22 = v21;
        LOBYTE(v23) = MiPteInShadowRange((UINT64)v48);
        if( v23 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v22 & 1) != 0 )
          v22 |= 0x8000000000000000ui64;
        v48->EnabledFeatures = v22;
        *(_QWORD *)ThreadContext = v12 + v20;
        return;
      }
    }
    goto LABEL_33;
  }
  if( (_DWORD)LargePageIndex )
  {
    v10 = 0x200000i64;
    goto LABEL_5;
  }
LABEL_33:
  v4 -= v9;
LABEL_17:
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 448, &LockHandle);
  PdpteBase = MmGetPdpteBase();
  if( v4 )
  {
    v35 = (v4 - *(&stru_140C4DB30 + 449)) >> 30;
    v36 = ZeroPte.u.Long;
    v37 = (unsigned __int64 *)((char *)&PdpteBase->u.Long + ((v4 >> 27) & 0x1FFFF8));
    LOBYTE(v38) = MiPteInShadowRange((UINT64)v37);
    if( v38 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
      v36 = ZeroPte.u.Long | 0x8000000000000000ui64;
    *v37 = v36;
    _bittestandset64(*(&stru_140C4DB30 + 454), v35);
  }
  if( (v6 & 2) != 0 )
  {
    *(_QWORD *)ThreadContext = 0i64;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
  }
  else
  {
    while( 1 )
    {
      SetBitsAndClear = RtlFindSetBitsAndClearEx(
                          (_RTL_BITMAP_EX *)((char *)&stru_140C4DB30 + 3608),
                          1ui64,
                          *(&stru_140C4DB30 + 450));
      v26 = SetBitsAndClear;
      if( SetBitsAndClear != -1i64 )
        break;
      KeFlushTb(FlushKernel, FlushAllProcessors);
      v42 = 0i64;
      for( i = *(&stru_140C4DB30 + 451) >> 6; v42 < i; *v44 |= v45 )
      {
        v44 = (_QWORD *)(*(&stru_140C4DB30 + 452) + 8 * v42);
        v45 = *(_QWORD *)(*(&stru_140C4DB30 + 454) + 8 * v42++);
      }
      memset(
        *(&stru_140C4DB30 + 454),
        0i64,
        4 * ((*(&stru_140C4DB30 + 453) >> 5) + ((*(&stru_140C4DB30 + 3624) & 0x1F) != 0)));
    }
    *(&stru_140C4DB30 + 450) = SetBitsAndClear + 1;
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    v27 = *(&stru_140C4DB30 + 449) + (v26 << 30);
    if( (v6 & 1) == 0 )
      *(_QWORD *)ThreadContext = v27 + (v7 << 12);
    if( v5 )
    {
      v28 = (__int64)MmGetPdpteBase() + ((v27 >> 27) & 0x1FFFF8);
      v29 = (_QWORD)MmGetPteBase() << 25;
      v30 = (INT64 *)(ThreadContext + 2);
      v31 = (v5 != 1) + 1i64;
      do
      {
        LODWORD(v32) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v28, *v30, 3087007748i64);
        v33 = v32;
        LOBYTE(v34) = MiPteInShadowRange(v28);
        if( v34 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v33 & 1) != 0 )
          v33 |= 0x8000000000000000ui64;
        *(_QWORD *)v28 = v33;
        ++v30;
        v28 = ((v28 << 25) - v29) >> 16;
        --v31;
      }
      while( v31 );
    }
  }
}

Referenced by: