MiAllocateVirtualMemory
__int64 __fastcall MiAllocateVirtualMemory(__int64 a1, __int64 *a2, __int64 *a3){
__int64 *v4;
_ETHREAD *CurrentThread;
unsigned int v7;
UINT8 v8;
UINT64 v9;
unsigned int ProtectionMask;
_KPROCESS *v11;
bool v12;
int v13;
int v14;
__int16 *v15;
__int16 v16;
int v17;
UINT64 v18;
UINT64 v19;
__int64 v20;
ULONG_PTR v21;
unsigned __int64 v22;
int v23;
BOOL v24;
INT64 v25;
unsigned __int64 v26;
VOID *v27;
__int64 v28;
int v29;
int v30;
int v31;
__int64 v33;
VOID *v34;
int v35;
unsigned int v36;
int v37;
ULONG_PTR v38;
unsigned __int64 v39;
int v40;
struct _DMA_ADAPTER *v41;
int v42;
unsigned __int64 v43;
ULONG_PTR v44;
unsigned __int64 v45;
__int64 v46;
__int64 v47;
int v48;
__int64 v49;
INT64 VadPageSize;
UINT64 *NewProtectWin32;
INT64 NewProtectWin32a;
KENLISTMENT *Enlistment;
UINT *v54;
UINT8 v55;
char v56;
__int16 v57;
UINT64 v58;
VOID *EndingAddress;
INT64 Locked;
UINT CapturedOldProtect;
int v62;
int v63;
_ETHREAD *v64;
UINT64 NewSectionSize;
unsigned __int64 v66;
unsigned __int64 v67;
UINT64 a4;
INT64 a3a;
INT64 v70[2];
__int64 SectionToExtend[2];
__int128 v72;
__int64 v73;
unsigned __int64 v74;
__int64 v75;
int v76;
int v77;
_KAPC_STATE ApcState;
Locked = 0i64;
v4 = a2;
CapturedOldProtect = 0;
v62 = 0;
v57 = 0;
*a3 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
if( (unsigned __int64)a2 >= 2 )
{
MiGetProcessPartition(*(_EPROCESS **)(a1 + 88));
if( *v4 == v46 )
v4 = 0i64;
}
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v7 = 2;
v8 = 1;
v9 = *(unsigned int *)(a1 + 44);
if( *(_QWORD *)(a1 + 8) - *(_QWORD *)a1 + 1i64 != *(_QWORD *)(a1 + 24) )
v7 = 0;
v64 = CurrentThread;
v55 = 1;
v56 = 0;
if( (v9 & 0x40000000) != 0 )
{
if( (v9 & 0xF0) == 0 )
return 3221225541i64;
LODWORD(v9) = v9 & 0xBFFFFFFF;
v8 = 0;
*(_DWORD *)(a1 + 44) = v9;
v55 = 0;
}
ProtectionMask = MiMakeProtectionMask(v9);
if( ProtectionMask != -1 )
{
v11 = *(_EPROCESS **)(a1 + 88);
if( *(_EPROCESS **)(a1 + 96) != v11 )
{
KiStackAttachProcess((_KPROCESS *)v11, 0i64, &ApcState);
v7 |= 1u;
}
v12 = (*(_DWORD *)(a1 + 60) & 0x4000000) == 0;
v58 = 0i64;
if( !v12 && v7 < 2 )
goto LABEL_103;
v13 = *(_DWORD *)(a1 + 40);
if( (v13 & 0x40000000) != 0 && !*(_QWORD *)(*(_QWORD *)(a1 + 88) + 2240i64) )
{
v31 = -1073741811;
goto LABEL_92;
}
v14 = *(_DWORD *)(a1 + 120) & 0x1A;
if( v14 )
{
if( (v14 & 2) != 0 )
{
v47 = 0xFFFFi64;
}
else if( (v14 & 8) != 0 )
{
v47 = 0x1FFFFFi64;
}
else
{
v47 = -1i64;
if( (v14 & 0x10) != 0 )
v47 = 0x3FFFFFFFi64;
}
if( ((*(_QWORD *)(a1 + 8) + 1i64) & v47) != 0 || (v47 & *(_QWORD *)a1) != 0 )
{
LABEL_103:
v31 = -1073741811;
goto LABEL_92;
}
v48 = v7 | 0x10;
if( (v13 & 0x20400000) == 0x400000 )
v48 = v7;
v7 = v48;
}
else if( (v13 & 0x20400000) == 0x20000000 )
{
v7 |= 0x10u;
}
if( v7 >= 0x10 && !SeSinglePrivilegeCheck(*(_QWORD *)&SeLockMemoryPrivilege, *(_BYTE *)(a1 + 104)) )
{
v31 = -1073741727;
goto LABEL_92;
}
MiGetProcessPartition(*(_EPROCESS **)(a1 + 88));
v16 = *v15;
v17 = *(_DWORD *)(a1 + 40);
v57 = v16;
if( (v17 & 0x2000) != 0 )
{
v31 = MiReserveUserMemory(a1, v4, ProtectionMask, v8, &v58, &v57);
if( v31 >= 0 )
goto LABEL_34;
}
else if( (v17 & 0x40000000) != 0 )
{
v31 = -1073741811;
}
else
{
if( !*(_QWORD *)(a1 + 80) )
{
v18 = *(_QWORD *)a1;
v19 = *(_QWORD *)a1;
EndingAddress = *(VOID **)(a1 + 8);
v66 = v19 >> 12;
v67 = (unsigned __int64)EndingAddress >> 12;
v58 = v18;
v20 = MiObtainReferencedVadEx(v18, 0, &Locked);
v21 = v20;
if( !v20 )
{
v31 = Locked;
if( (_DWORD)Locked == -1073741664 )
v31 = -1073741800;
goto LABEL_92;
}
if( (unsigned __int64)EndingAddress >> 12 > (*(unsigned int *)(v20 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v20 + 33) << 32)) )
{
v31 = -1073741800;
goto LABEL_91;
}
if( (*(_DWORD *)(v20 + 48) & 0x1100000) != 17825792 && *(_DWORD *)(a1 + 48) )
{
v31 = -1073741800;
goto LABEL_91;
}
v22 = v58;
*a3 = v58;
v23 = *(_DWORD *)(v20 + 48);
if( (v23 & 0x3100000) == 34603008 )
{
v49 = v23 & 0x70;
if( (_BYTE)v49 == 48 )
{
v35 = MiCommitEnclavePages(
v49,
v20,
v22,
(unsigned __int64)EndingAddress,
*(_DWORD *)(a1 + 40),
ProtectionMask);
LABEL_46:
v31 = v35;
if( v35 < 0 )
goto LABEL_91;
MiUnlockAndDereferenceVad((PVOID)v21);
LABEL_34:
if( (v7 & 1) != 0 )
KiUnstackDetachProcess(&ApcState, 0i64);
if( (ProtectionMask & 2) != 0 )
{
LODWORD(Enlistment) = *(_DWORD *)(a1 + 44);
LODWORD(NewProtectWin32a) = *(_DWORD *)(a1 + 40);
EtwTiLogAllocExecVm(
*(_QWORD *)(a1 + 88),
*(_BYTE *)(a1 + 104),
v58,
*(_QWORD *)(a1 + 32),
NewProtectWin32a,
Enlistment);
}
*a3 = v58;
return(unsigned int)v31;
}
if( (*(_DWORD *)(a1 + 60) & 0x10000000) == 0 )
{
v31 = -1073741664;
goto LABEL_91;
}
}
v24 = MiVadSupportsPrivateCommit(v20);
v26 = v58;
if( v24 )
{
v27 = EndingAddress;
}
else
{
if( (*(_DWORD *)(v21 + 48) & 0x500000) != 5242880 )
{
v31 = -1073741800;
goto LABEL_91;
}
VadPageSize = MiGetVadPageSize(v25);
v27 = EndingAddress;
if( (((VadPageSize << 12) - 1) & (v26 | ((unsigned __int64)EndingAddress + 1))) != 0 )
{
v31 = -1073741811;
goto LABEL_91;
}
}
v28 = *(unsigned int *)(v21 + 52);
LODWORD(v28) = v28 & 0x7FFFFFFF;
if( (v28 | ((unsigned __int64)*(unsigned __int8 *)(v21 + 34) << 31)) >= 0x7FFFFFFFDi64 )
{
v31 = -1073741800;
goto LABEL_91;
}
if( (*(_DWORD *)(v21 + 48) & 0x70) != 64 )
{
LABEL_26:
if( (*(_DWORD *)(a1 + 40) & 0x1080000) != 0 )
{
LODWORD(NewProtectWin32) = *(_DWORD *)(a1 + 40);
v35 = MiResetVirtualMemory(
*(_EPROCESS **)(a1 + 96),
(VOID *)v26,
v27,
(_MMVAD *)v21,
(UINT64)NewProtectWin32);
}
else
{
if( (ProtectionMask & 2) != 0 )
{
v31 = MiAllowProtectionChange(
*(_EPROCESS **)(a1 + 88),
*(_EPROCESS **)(a1 + 96),
(_MMVAD *)v21,
ProtectionMask,
(VOID *)v26,
v27);
if( v31 < 0 )
goto LABEL_91;
if( (!v55 || (*(_DWORD *)(v21 + 48) & 0x100) == 0) && MiIsProcessCfgEnabled() )
{
if( (*(_DWORD *)(v21 + 48) & 8) != 0 )
{
v31 = MiCheckSecuredVad(v21, v58, *(_QWORD *)(a1 + 24), ProtectionMask, *(_BYTE *)(a1 + 104));
if( v31 < 0 )
goto LABEL_91;
LOBYTE(v7) = v7 | 4;
}
v70[0] = v58;
v70[1] = (INT64)EndingAddress;
v31 = MiCommitVadCfgBits(v21, (INT64)v70, &v55);
if( v31 < 0 )
goto LABEL_91;
v56 = 1;
}
v26 = v58;
}
v29 = *(_DWORD *)(v21 + 48);
v30 = *(_DWORD *)(a1 + 44);
if( (v29 & 0x100000) != 0 )
{
if( (v30 & 0x88) != 0 || (v29 & 0x70) == 64 && (v30 & 0xFFFFF9F9) != 0 )
goto LABEL_60;
if( (v29 & 8) == 0 )
{
LABEL_32:
Enlistment = *(KENLISTMENT **)(a1 + 120);
LODWORD(NewProtectWin32) = *(_DWORD *)(a1 + 48);
v31 = MiCommitExistingVad(
(_MMVAD_SHORT *)v21,
(PVOID)v26,
*(_QWORD *)(a1 + 24),
*(unsigned int *)(a1 + 44),
NewProtectWin32);
if( v31 >= 0 )
{
MiUnlockAndDereferenceVad((PVOID)v21);
if( v62 == 1 )
{
a3a = v58;
a4 = *(_QWORD *)(a1 + 24);
v40 = *(_DWORD *)(a1 + 44);
v63 = 0;
if( v56 && !v55 )
v40 |= 0x40000000u;
LODWORD(NewProtectWin32a) = v40;
MmProtectVirtualMemory(
*(VOID **)(a1 + 96),
*(LARGE_INTEGER **)(a1 + 88),
&a3a,
&a4,
NewProtectWin32a,
(KENLISTMENT *)&v63);
}
goto LABEL_34;
}
LABEL_91:
MiUnlockAndDereferenceVad((PVOID)v21);
goto LABEL_92;
}
if( !MiLocateVadEvent(v21, 64i64) )
{
v31 = MiCheckSecuredVad(v38, v39, *(_QWORD *)(a1 + 24), ProtectionMask, *(_BYTE *)(a1 + 104));
if( v31 < 0 )
goto LABEL_91;
v26 = v58;
goto LABEL_32;
}
LABEL_60:
v31 = -1073741755;
goto LABEL_91;
}
if( (v30 & 0x600) != 0 )
goto LABEL_60;
if( (v29 & 8) != 0 && (v7 & 4) == 0 )
{
v31 = MiCheckSecuredVad(v21, v26, *(_QWORD *)(a1 + 24), ProtectionMask, *(_BYTE *)(a1 + 104));
if( v31 < 0 )
goto LABEL_91;
}
v33 = **(_QWORD **)(v21 + 72);
v57 = *(_WORD *)MiGetControlAreaPartition((_CONTROL_AREA *)v33);
if( *(_QWORD *)(v33 + 64) )
{
if( *(__int64 *)(v21 + 120) >= 0 )
{
v31 = -1073741791;
}
else
{
NewSectionSize = (UINT64)EndingAddress
+ ((unsigned __int64)(*(_DWORD *)(v21 + 64) & 0xFFFFFF) << 16)
- ((*(unsigned int *)(v21 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v21 + 32) << 32)) << 12)
+ 1;
if( (unsigned int)MiFlushAcquire((_CONTROL_AREA *)v33, 0i64, 0i64) )
{
v41 = 0i64;
if( (*(_DWORD *)(v21 + 48) & 0x100000) == 0 && *(_QWORD *)(v21 + 128) )
{
v41 = *(struct _DMA_ADAPTER **)(v21 + 128);
ObfReferenceObject(v41);
}
MiUnlockVad((__int64)v64, v21);
v42 = *(_DWORD *)(v33 + 56);
v72 = 0i64;
SectionToExtend[0] = 0i64;
SectionToExtend[1] = 0i64;
v73 = 0i64;
v75 = 0i64;
if( v41 )
{
if( (v42 & 0x20) != 0 )
v74 = (unsigned __int64)v41 | 1;
else
v74 = (unsigned __int64)v41 | 2;
}
else
{
v74 = v33;
}
v76 = v42;
v77 = 4;
v31 = MmExtendSection(SectionToExtend, &NewSectionSize, 0i64);
if( v41 )
HalPutDmaAdapter(v41);
MiLockVad((__int64)v64, v21);
MiFlushRelease((_CONTROL_AREA *)v33, 0i64, 0i64);
if( v31 >= 0
&& (unsigned int)MiVadDeleted(v21) != 1
&& v66 >= v45
&& v66 <= v43
&& v67 <= v43
&& v67 >= v45
&& ((*(_DWORD *)(v21 + 48) & 8) == 0
|| (int)MiCheckSecuredVad(v44, v58, *(_QWORD *)(a1 + 24), ProtectionMask, *(_BYTE *)(a1 + 104)) >= 0)
&& *(__int64 *)(v21 + 120) < 0 )
{
LODWORD(Enlistment) = 0;
LODWORD(NewProtectWin32) = *(_DWORD *)(a1 + 44);
v31 = MiSetProtectionOnSection(
*(_EPROCESS **)(a1 + 88),
(_MMVAD *)v21,
(void *)v58,
EndingAddress,
(UINT64)NewProtectWin32,
(UINT64)Enlistment,
&CapturedOldProtect,
(UINT *)&Locked + 1);
}
}
else
{
v31 = -1073741670;
}
}
goto LABEL_91;
}
LODWORD(NewProtectWin32) = *(_DWORD *)(a1 + 44);
v35 = MiCommitPagefileBackedSection(
*(_EPROCESS **)(a1 + 88),
(_MMVAD *)v21,
v34,
EndingAddress,
(UINT64)NewProtectWin32,
(UINT64)Enlistment,
(UINT64)v54,
&CapturedOldProtect,
(UINT *)&Locked + 1);
}
goto LABEL_46;
}
v36 = *(_DWORD *)(a1 + 44) & 0xFFFFF9FF;
*(_DWORD *)(a1 + 44) = v36;
v37 = *(_DWORD *)(v21 + 48) & 0xC00;
if( (*(_DWORD *)(v21 + 48) & 0x380) != 0 && v37 == 3072 )
{
v36 |= 0x400u;
}
else
{
if( v37 != 1024 )
{
LABEL_59:
ProtectionMask = MiMakeProtectionMask(v36);
if( ProtectionMask == -1 )
goto LABEL_60;
goto LABEL_26;
}
v36 |= 0x200u;
}
*(_DWORD *)(a1 + 44) = v36;
goto LABEL_59;
}
v31 = -1073741811;
}
LABEL_92:
if( (v7 & 1) != 0 )
KiUnstackDetachProcess(&ApcState, 0i64);
return(unsigned int)v31;
}
return 3221225541i64;
}Referenced by:
MiAllocateVirtualMemoryCommon
MmAllocateVirtualMemory
MmStoreAllocateVirtualMemory
NtAllocateVirtualMemory