MiObtainSystemCacheView
_MMPTE *__stdcall MiObtainSystemCacheView(_MI_PARTITION *Partition){
_ETHREAD *CurrentThread;
unsigned int v3;
unsigned __int8 CurrentIrql;
volatile signed __int64 *v5;
__int64 v6;
_MMPTE *v7;
__int64 v8;
_MMPTE *v9;
__int64 v10;
NTSTATUS PteLink;
int v12;
unsigned int v13;
__int64 v14;
unsigned __int64 v15;
int v16;
unsigned __int64 v17;
int v18;
unsigned __int64 v19;
int v20;
unsigned __int64 v21;
int v22;
_MMPTE *v24;
volatile signed __int64 *v25;
__int64 v26;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v27;
__int64 v28;
__int64 *v29;
__int64 v30;
_MMPTE *PteBase;
UINT64 v32;
__int64 v33;
int v34;
int v35;
NTSTATUS v36;
unsigned int v37;
__int64 v38;
signed __int64 v39;
_EX_PUSH_LOCK *v40;
char v41;
_ETHREAD *v42;
unsigned int v43;
int v44;
bool v45;
__int64 v46;
_KLOCK_ENTRY *v47;
int v48;
unsigned int v49;
__int64 v50;
_EX_PUSH_LOCK *p_SystemCacheInitLock;
_ETHREAD *v52;
unsigned int v53;
unsigned __int8 v54;
int v55;
__int64 v56;
_KLOCK_ENTRY *v57;
int v58;
unsigned int v59;
__int64 v60;
_ETHREAD *v61;
__int64 SessionId;
_EX_PUSH_LOCK *v63;
int v64;
__int64 v65;
_KLOCK_ENTRY *v66;
int v67;
unsigned int v68;
__int64 v69;
unsigned __int8 v70;
UINT64 v71;
_MI_TB_FLUSH_LIST *v72;
_EX_PUSH_LOCK *v73;
_MMPTE *v74;
__int64 v75;
__int64 v76;
_EX_PUSH_LOCK *v77;
int v78;
__int64 v79;
_KLOCK_ENTRY *v80;
int v81;
unsigned int v82;
unsigned __int8 v83;
__int64 v84;
int v85;
VOID *v86;
__int64 v87;
UINT64 v88;
INT64 v89;
INT64 v90;
unsigned __int64 Long;
int v92;
unsigned __int64 v93;
int v94;
unsigned __int64 v95;
int v96;
unsigned __int8 v97;
__int64 v98;
int v99[8];
PVOID BugCheckParameter4;
unsigned __int8 AbAllocationRegionCount;
_MMPTE *v102;
int v103;
unsigned int v104;
_ETHREAD *v105;
int v106;
UINT64 v107;
UINT64 v108;
UINT64 v109;
int a3;
_KLOCK_QUEUE_HANDLE a3_4;
VOID *Va;
volatile signed __int64 *v113;
UINT64 v114;
unsigned __int64 v115;
_KLOCK_ENTRY *v116;
_MI_TB_FLUSH_LIST TbFlushList;
__int16 v118;
__int16 v119;
__int64 v120;
__int64 v121;
__int64 v122;
char v123[152];
__int64 v124[12];
Va = 0i64;
v114 = 0i64;
v119 = 0;
memset(v123, 0i64, sizeof(v123));
*(_QWORD *)&a3_4.OldIrql = 0i64;
memset(v124, 0i64, sizeof(v124));
v120 = 20i64;
CurrentThread = 0i64;
TbFlushList = 0;
v3 = 0;
v118 = 0;
v121 = 0i64;
v122 = 0i64;
v105 = 0i64;
v103 = 0;
v104 = 0;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
a3_4.LockQueue.Next = 0i64;
a3_4.LockQueue.Lock = (unsigned __int64 *volatile)((char *)&stru_140C4DB30 + 1464);
KxAcquireQueuedSpinLock(&a3_4.LockQueue, (UINT64 *)&stru_140C4DB30 + 183);
if( !Partition->Vp.SystemCacheInitialized )
{
KeReleaseInStackQueuedSpinLockFromDpcLevel(&a3_4);
__writecr8(CurrentIrql);
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v105 = CurrentThread;
--CurrentThread->Tcb.SpecialApcDisable;
p_SystemCacheInitLock = &Partition->Segments.SystemCacheInitLock;
ExAcquirePushLockExclusiveEx(&Partition->Segments.SystemCacheInitLock, 0i64);
if( Partition->Vp.SystemCacheInitialized )
{
if( (_InterlockedExchangeAdd64(&p_SystemCacheInitLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&Partition->Segments.SystemCacheInitLock);
v61 = (_ETHREAD *)KeGetCurrentThread();
LODWORD(v108) = 0;
if( MiGetSystemRegionType((UINT64)&Partition->Segments.SystemCacheInitLock) == 1 )
SessionId = (unsigned int)MmGetSessionIdEx(v61->Tcb.ApcState.Process);
else
SessionId = 0xFFFFFFFFi64;
--v61->Tcb.SpecialApcDisable;
++v61->Tcb.AbAllocationRegionCount;
v63 = &Partition->Segments.SystemCacheInitLock;
AbAllocationRegionCount = v61->Tcb.AbAllocationRegionCount;
v64 = ((char)v61->Tcb.AbEntrySummary | (char)v61->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v45 = !_BitScanReverse((unsigned int *)&v65, v64);
HIDWORD(v107) = v65;
if( v45 )
goto LABEL_109;
while( 1 )
{
v66 = &v61->Tcb.LockEntries[v65];
v102 = (_MMPTE *)v66;
v64 &= ~(1 << v65);
if( (v66->AcquiredByte & 1) != 0
&& (v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)&Partition->Segments.SystemCacheInitLock & 0x7FFFFFFFFFFFFFFCi64)
&& v66->LockState.SessionId == (_DWORD)SessionId )
{
v66->AcquiredByte &= ~1u;
if( v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v45 = !_BitScanReverse((unsigned int *)&v65, v64);
HIDWORD(v107) = v65;
if( v45 )
goto LABEL_109;
}
if( !v66 )
{
LABEL_109:
if( (*(&v61->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v61, &Partition->Segments.SystemCacheInitLock, (PVOID)SessionId, 0i64);
}
else
{
v66->CrossThreadReleasableAndBusyByte |= 2u;
if( v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v66);
v66 = (_KLOCK_ENTRY *)v102;
v63 = &Partition->Segments.SystemCacheInitLock;
}
v67 = v66->BoostBitmap.AllFields & 0x1FFFF;
v68 = v66->BoostBitmap.AllFields & 0xFFFE0000;
v66->ThreadLocalFlags &= ~1u;
LODWORD(v108) = v67;
v66->BoostBitmap.AllFields = v68;
v66->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v69 = (__int64)((unsigned __int128)(((char *)v66 - (char *)v61->Tcb.LockEntries)
* (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 4;
v70 = 1 << (v69 + (v69 < 0));
if( AbAllocationRegionCount == 1 )
v61->Tcb.AbEntrySummary |= v70;
else
_InterlockedOr8((volatile signed __int8 *)&v61->Tcb.AbOrphanedEntrySummary, v70);
}
--v61->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v61->Tcb, v63, &v108);
v45 = v61->Tcb.SpecialApcDisable++ == -1;
if( v45 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v61->Tcb.ApcState.ApcListHead[0].Flink != &v61->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
CurrentThread = 0i64;
v105 = 0i64;
}
else if( !MiInitializeSystemCache(Partition) )
{
if( (_InterlockedExchangeAdd64(&p_SystemCacheInitLock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(&Partition->Segments.SystemCacheInitLock);
v52 = (_ETHREAD *)KeGetCurrentThread();
LODWORD(v107) = 0;
if( MiGetSystemRegionType((UINT64)&Partition->Segments.SystemCacheInitLock) == 1 )
v53 = MmGetSessionIdEx(v52->Tcb.ApcState.Process);
else
v53 = -1;
--v52->Tcb.SpecialApcDisable;
v54 = ++v52->Tcb.AbAllocationRegionCount;
v55 = ((char)v52->Tcb.AbEntrySummary | (char)v52->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v45 = !_BitScanReverse((unsigned int *)&v56, v55);
v106 = v56;
if( v45 )
goto LABEL_85;
while( 1 )
{
v57 = &v52->Tcb.LockEntries[v56];
v55 &= ~(1 << v56);
if( (v57->AcquiredByte & 1) != 0
&& (v57->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v57->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)p_SystemCacheInitLock & 0x7FFFFFFFFFFFFFFCi64)
&& v57->LockState.SessionId == v53 )
{
v57->AcquiredByte &= ~1u;
if( v57->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v45 = !_BitScanReverse((unsigned int *)&v56, v55);
v106 = v56;
if( v45 )
goto LABEL_85;
}
if( !v57 )
{
LABEL_85:
if( (*(&v52->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v52, p_SystemCacheInitLock, (PVOID)v53, 0i64);
}
else
{
v57->CrossThreadReleasableAndBusyByte |= 2u;
if( v57->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v57);
v58 = v57->BoostBitmap.AllFields & 0x1FFFF;
v59 = v57->BoostBitmap.AllFields & 0xFFFE0000;
v57->ThreadLocalFlags &= ~1u;
LODWORD(v107) = v58;
v57->BoostBitmap.AllFields = v59;
v57->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v60 = v57 - v52->Tcb.LockEntries;
if( v54 == 1 )
v52->Tcb.AbEntrySummary |= 1 << v60;
else
_InterlockedOr8((volatile signed __int8 *)&v52->Tcb.AbOrphanedEntrySummary, 1 << v60);
}
--v52->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v52->Tcb, p_SystemCacheInitLock, &v107);
v45 = v52->Tcb.SpecialApcDisable++ == -1;
if( v45 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v52->Tcb.ApcState.ApcListHead[0].Flink != &v52->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
return 0i64;
}
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
a3_4.LockQueue.Next = 0i64;
a3_4.LockQueue.Lock = (unsigned __int64 *volatile)((char *)&stru_140C4DB30 + 1464);
KxAcquireQueuedSpinLock(&a3_4.LockQueue, (UINT64 *)&stru_140C4DB30 + 183);
if( CurrentThread )
Partition->Vp.SystemCacheInitialized = 1;
}
v5 = (volatile signed __int64 *)((char *)MmGetPteBase()
+ (((unsigned __int64)&Partition->Segments.FreeSystemCache >> 9) & 0x7FFFFFFFF8i64));
v113 = v5;
do
{
LODWORD(v6) = MiGetPteLink(Partition->Segments.FreeSystemCache.Flink.u.Long);
if( v6 != ((char *)v5 - (char *)Partition->Segments.FreeSystemCache.PteBase) >> 3 )
goto LABEL_4;
}
while( MiExpandSystemCache((_KTHREAD **)Partition, &v114) );
KeReleaseInStackQueuedSpinLockFromDpcLevel(&a3_4);
__writecr8(CurrentIrql);
if( CurrentThread )
{
v73 = &Partition->Segments.SystemCacheInitLock;
if( (_InterlockedExchangeAdd64(&Partition->Segments.SystemCacheInitLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
{
ExfTryToWakePushLock(v73);
v73 = &Partition->Segments.SystemCacheInitLock;
}
v74 = (_MMPTE *)KeGetCurrentThread();
v102 = v74;
LODWORD(v109) = 0;
if( MiGetSystemRegionType((UINT64)v73) == 1 )
v75 = (unsigned int)MmGetSessionIdEx((_EPROCESS *)v74[23].u.Long);
else
v75 = 0xFFFFFFFFi64;
--HIWORD(v74[60].u.TimeStamp._bf_0);
v76 = (__int64)v74;
++BYTE2(v74[99].u.VolatileLong);
v77 = &Partition->Segments.SystemCacheInitLock;
AbAllocationRegionCount = BYTE2(v74[99].u.VolatileLong);
v115 = (unsigned __int64)&Partition->Segments.SystemCacheInitLock & 0x7FFFFFFFFFFFFFFCi64;
v78 = (SLOBYTE(v74[99].u.Long) | SBYTE6(v74[108].u.TimeStamp._bf_0)) ^ 0x3F;
v45 = !_BitScanReverse((unsigned int *)&v79, v78);
HIDWORD(v108) = v79;
if( v45 )
goto LABEL_142;
while( 1 )
{
LODWORD(v105) = ~(1 << v79) & v78;
v80 = (_KLOCK_ENTRY *)(v74[100].u.Long + 96 * v79);
v116 = v80;
if( (v80->AcquiredByte & 1) != 0
&& (v80->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v80->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == v115
&& v80->LockState.SessionId == (_DWORD)v75 )
{
v80->AcquiredByte &= ~1u;
if( v80->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v78 = (int)v105;
v45 = !_BitScanReverse((unsigned int *)&v79, (unsigned int)v105);
HIDWORD(v108) = v79;
if( v45 )
goto LABEL_142;
}
if( !v80 )
{
LABEL_142:
if( (v74[15].u.Long & 0x10000) == 0 )
KeBugCheckEx(0x162u, v74, &Partition->Segments.SystemCacheInitLock, (PVOID)v75, 0i64);
}
else
{
v80->CrossThreadReleasableAndBusyByte |= 2u;
if( v80->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v80);
v76 = (__int64)v102;
v77 = &Partition->Segments.SystemCacheInitLock;
v80 = v116;
}
v81 = v80->BoostBitmap.AllFields & 0x1FFFF;
v82 = v80->BoostBitmap.AllFields & 0xFFFE0000;
v80->ThreadLocalFlags &= ~1u;
LODWORD(v109) = v81;
v80->BoostBitmap.AllFields = v82;
v80->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v83 = 1 << ((char)((_BYTE)v80 - *(_BYTE *)(v76 + 800)) / 96);
if( AbAllocationRegionCount == 1 )
*(_BYTE *)(v76 + 792) |= v83;
else
_InterlockedOr8((volatile signed __int8 *)(v76 + 870), v83);
}
--*(_BYTE *)(v76 + 794);
KiAbThreadRemoveBoosts((_KTHREAD *)v76, v77, &v109);
v84 = (__int64)v102;
v45 = HIWORD(v102[60].u.TimeStamp._bf_0)++ == 0xFFFF;
if( v45 && *(_QWORD *)(v84 + 152) != v84 + 152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
v105 = 0i64;
}
if( v114 )
MiReturnSystemVa((VOID *)v114, (VOID *)(v114 + 0x200000), MiVaSystemCache, v72);
CcUnmapInactiveViews((UINT64)Partition->Core.PartitionObject, v71, 0i64);
if( v85 == 1 )
{
v86 = Va;
v7 = (_MMPTE *)((char *)MmGetPteBase() + (((unsigned __int64)Va >> 9) & 0x7FFFFFFFF8i64));
LODWORD(v87) = MiGetPteLink(v7[3].u.Long);
if( v87 == 2 )
{
LODWORD(v88) = MiGetPteLink(v7[2].u.Long);
if( MiCompareTbFlushTimeStamp(v88, 0xFFFFFui64, v89, v90, (UINT64)BugCheckParameter4) )
{
MiInsertTbFlushEntry(&TbFlushList, v86, 0x40ui64, 0i64);
MiFlushTbList(&TbFlushList);
}
}
Long = ZeroPte.u.Long;
LOBYTE(v92) = MiPteInShadowRange((UINT64)v7);
if( v92 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
Long = ZeroPte.u.Long | 0x8000000000000000ui64;
v7->u.Long = Long;
v93 = ZeroPte.u.Long;
LOBYTE(v94) = MiPteInShadowRange((UINT64)&v7[1]);
if( v94 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v93 = ZeroPte.u.Long | 0x8000000000000000ui64;
v7[1].u.Long = v93;
v95 = ZeroPte.u.Long;
LOBYTE(v96) = MiPteInShadowRange((UINT64)&v7[2]);
if( v96 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v95 = ZeroPte.u.Long | 0x8000000000000000ui64;
v7[2].u.Long = v95;
return v7;
}
v97 = KeGetCurrentIrql();
__writecr8(2ui64);
a3_4.LockQueue.Next = 0i64;
a3_4.LockQueue.Lock = (unsigned __int64 *volatile)((char *)&stru_140C4DB30 + 1464);
CurrentIrql = v97;
KxAcquireQueuedSpinLock(&a3_4.LockQueue, (UINT64 *)&stru_140C4DB30 + 183);
LODWORD(v98) = MiGetPteLink(Partition->Segments.FreeSystemCache.Flink.u.Long);
if( v98 != ((char *)v5 - (char *)Partition->Segments.FreeSystemCache.PteBase) >> 3 )
{
LABEL_4:
v7 = RemoveListHeadPte(&Partition->Segments.FreeSystemCache);
v8 = (_QWORD)MmGetPteBase() << 25;
MiIncrementSystemCacheViewCount((((_QWORD)v7 << 25) - v8) >> 16);
v9 = v7 + 3;
LODWORD(v10) = MiGetPteLink(v7[3].u.Long);
if( v10 )
{
if( v10 == 1 )
{
v3 = 1;
}
else
{
_InterlockedOr(v99, 0);
PteLink = MiGetPteLink(v7[2].u.Long);
v13 = (v12 - PteLink) & 0xFFFFF;
if( v13 <= 2 && ((PteLink & 1) != 0 || v13 < 2) )
{
v102 = v7 + 3;
v24 = v7;
v25 = v113;
do
{
if( HIDWORD(v120) )
{
v26 = v3++;
v124[v26] = (__int64)v24;
}
Va = (VOID *)((((_QWORD)v24 << 25) - v8) >> 16);
MiInsertTbFlushEntry(&TbFlushList, Va, 0x40ui64, 0i64);
v27.Long = (unsigned __int64)v102->u;
if( *(&stru_140C4DB30 + 42) )
{
if( (v27.Long & 0x10) != 0 )
LODWORD(v27.Long) &= ~0x10u;
else
LODWORD(v27.Long) &= ~*(&stru_140C4DB30 + 84);
}
v28 = MiSwizzleInvalidPte(v27.Long & 0xFFFFFFF | 0x10000000i64);
*v29 = v28;
if( v3 == 12 )
break;
LODWORD(v30) = MiGetPteLink(v24->u.Long);
PteBase = Partition->Segments.FreeSystemCache.PteBase;
if( v30 == ((char *)v25 - (char *)PteBase) >> 3 )
break;
v24 = &PteBase[v30];
v32 = v24[3].u.Long;
v102 = v24 + 3;
LODWORD(v33) = MiGetPteLink(v32);
}
while( v33 == 2 );
v103 = v3;
v9 = v7 + 3;
v3 = v104;
}
}
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&a3_4);
if( HIDWORD(v120) )
{
MiFlushTbList(&TbFlushList);
v34 = v103;
v104 = 0;
if( v103 )
{
v35 = v104;
do
{
v113 = (volatile signed __int64 *)(v124[v35] + 24);
v36 = MI_READ_PTE_LOCK_FREE((INT64)v113);
v37 = v36;
if( *(&stru_140C4DB30 + 42) )
{
if( (v36 & 0x10) != 0 )
v37 = v36 & 0xFFFFFFEF;
else
v37 = v36 & ~*(&stru_140C4DB30 + 84);
}
v38 = MiSwizzleInvalidPte(v37 & 0xFFFFFFF);
_InterlockedCompareExchange64(v113, v38, v39);
++v35;
}
while( v35 != v34 );
v9 = v7 + 3;
}
}
__writecr8(CurrentIrql);
v14 = (__int64)v105;
if( v105 )
{
v40 = &Partition->Segments.SystemCacheInitLock;
v41 = _InterlockedExchangeAdd64(&Partition->Segments.SystemCacheInitLock._bf_0, 0xFFFFFFFFFFFFFFFFui64);
if( (v41 & 2) != 0 && (v41 & 4) == 0 )
ExfTryToWakePushLock(&Partition->Segments.SystemCacheInitLock);
v42 = (_ETHREAD *)KeGetCurrentThread();
a3 = 0;
if( MiGetSystemRegionType((UINT64)&Partition->Segments.SystemCacheInitLock) == 1 )
v43 = MmGetSessionIdEx(v42->Tcb.ApcState.Process);
else
v43 = -1;
--v42->Tcb.SpecialApcDisable;
++v42->Tcb.AbAllocationRegionCount;
v44 = ((char)v42->Tcb.AbEntrySummary | (char)v42->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
AbAllocationRegionCount = v42->Tcb.AbAllocationRegionCount;
v45 = !_BitScanReverse((unsigned int *)&v46, v44);
HIDWORD(v109) = v46;
if( v45 )
goto LABEL_47;
while( 1 )
{
v47 = &v42->Tcb.LockEntries[v46];
v44 &= ~(1 << v46);
if( (v47->AcquiredByte & 1) != 0
&& (v47->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v47->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == ((unsigned __int64)v40 & 0x7FFFFFFFFFFFFFFCi64)
&& v47->LockState.SessionId == v43 )
{
v47->AcquiredByte &= ~1u;
if( v47->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v45 = !_BitScanReverse((unsigned int *)&v46, v44);
HIDWORD(v109) = v46;
if( v45 )
goto LABEL_47;
}
if( !v47 )
{
LABEL_47:
if( (*(&v42->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v42, v40, (PVOID)v43, 0i64);
}
else
{
v47->CrossThreadReleasableAndBusyByte |= 2u;
if( v47->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v47);
v48 = v47->BoostBitmap.AllFields & 0x1FFFF;
v49 = v47->BoostBitmap.AllFields & 0xFFFE0000;
v47->ThreadLocalFlags &= ~1u;
a3 = v48;
v47->BoostBitmap.AllFields = v49;
v47->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v50 = v47 - v42->Tcb.LockEntries;
if( AbAllocationRegionCount == 1 )
v42->Tcb.AbEntrySummary |= 1 << v50;
else
_InterlockedOr8((volatile signed __int8 *)&v42->Tcb.AbOrphanedEntrySummary, 1 << v50);
}
--v42->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v42->Tcb, v40, (UINT64 *)&a3);
v45 = v42->Tcb.SpecialApcDisable++ == -1;
if( v45 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v42->Tcb.ApcState.ApcListHead[0].Flink != &v42->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe(v14);
}
if( v3 == 1 )
MiWaitForSystemCacheViewFlush((_MI_FREE_SYSTEM_CACHE *)v7);
v15 = ZeroPte.u.Long;
LOBYTE(v16) = MiPteInShadowRange((UINT64)v7);
if( v16 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v15 = ZeroPte.u.Long | 0x8000000000000000ui64;
v7->u.Long = v15;
v17 = ZeroPte.u.Long;
LOBYTE(v18) = MiPteInShadowRange((UINT64)&v7[1]);
if( v18 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v17 = ZeroPte.u.Long | 0x8000000000000000ui64;
v7[1].u.Long = v17;
v19 = ZeroPte.u.Long;
LOBYTE(v20) = MiPteInShadowRange((UINT64)&v7[2]);
if( v20 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v19 = ZeroPte.u.Long | 0x8000000000000000ui64;
v7[2].u.Long = v19;
v21 = ZeroPte.u.Long;
LOBYTE(v22) = MiPteInShadowRange((UINT64)v9);
if( v22 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v21 = ZeroPte.u.Long | 0x8000000000000000ui64;
v9->u.Long = v21;
return v7;
}
KeReleaseInStackQueuedSpinLockFromDpcLevel(&a3_4);
__writecr8(v97);
return 0i64;
}Referenced by:
MmMapViewInSystemCache
MmReserveViewInSystemCache