MiLockStealSystemVm

INT64 __fastcall MiLockStealSystemVm(UINT64 a1, UINT8 a2, INT64 a3, INT64 a4){
  unsigned __int64 v6; 
  _MMPTE *PteBase; 
  UNICODE_STRING *v8; 
  unsigned __int64 v9; 
  unsigned int SystemRegionType; 
  _MMPTE *v11; 
  unsigned int v12; 
  unsigned int v13; 
  char v14; 
  bool v15; 
  int v16; 
  CHAR *AnyMultiplexedVm; 
  CHAR *v18; 
  void *v19; 
  __int64 SessionVm; 
  CHAR *v21; 
  int v22; 
  unsigned __int64 v23; 
  WCHAR *v24; 
  int v26; 
  INT64 v27; 
  int IsPfnFileOnly; 
  int v29; 
  unsigned int v30; 
  INT64 v31; 
  INT64 v32; 
  UNICODE_STRING *antNameB; 
  v32 = a3;
  v6 = a2;
  PteBase = MmGetPteBase();
  v8 = *(UNICODE_STRING **)(qword_140C4E388 + 8 * ((*(_QWORD *)(a1 + 40) >> 39) & 0x3FFi64));
  antNameB = v8;
  v9 = ((a3 << 25) - ((_QWORD)PteBase << 25)) >> 16;
  SystemRegionType = MiGetSystemRegionType(v9);
  v11 = PteBase;
  v12 = 0;
  if( v9 < (unsigned __int64)v11 || (v13 = 1, v9 > (unsigned __int64)MmGetPteLimit()) )
    v13 = 0;
  if( SystemRegionType == 5 )
  {
    v14 = *(_BYTE *)(a1 + 35);
    _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
    v15 = (v14 & 0x10) == 0;
    v16 = KiIrqlFlags;
    if( v15 )
    {
      __writecr8(v6);
      AnyMultiplexedVm = MiGetAnyMultiplexedVm(5i64);
      *(_DWORD *)(a4 + 8) |= 0x20u;
      v18 = AnyMultiplexedVm;
      goto LABEL_19;
    }
    goto LABEL_39;
  }
  if( SystemRegionType != 1 )
  {
    if( SystemRegionType == 6 )
    {
      _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v6);
      v21 = MiGetAnyMultiplexedVm(2i64);
      *(_DWORD *)(a4 + 8) |= 0x10u;
      v18 = v21;
    }
    else if( SystemRegionType == 12 )
    {
      _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v6);
      v18 = MiGetAnyMultiplexedVm(1i64);
      *(_DWORD *)(a4 + 48) = v22;
    }
    else
    {
      if( SystemRegionType != 9 || !MiVaIsPageFileHash((__int64)v8, v9) )
      {
        _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
        v16 = KiIrqlFlags;
LABEL_39:
        if( v16 && (v16 & 1) != 0 )
          KeGetCurrentIrql();
        __writecr8(v6);
        return 0i64;
      }
      v18 = MiGetAnyMultiplexedVm(3i64);
      *(_DWORD *)(a4 + 48) = 2;
      _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v6);
    }
    goto LABEL_19;
  }
  *(_QWORD *)(a4 + 56) = MiReferenceOwningSession(a1);
  _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(v6);
  v19 = *(void **)(a4 + 56);
  if( v19 )
  {
    if( MmAttachSession(v19, (KAPC_STATE *)(a4 + 72)) < 0 )
    {
      *(_QWORD *)(a4 + 56) = 0i64;
      return 0i64;
    }
    SessionVm = MiGetSessionVm();
    *(_DWORD *)(a4 + 8) |= 0x80u;
    v18 = (CHAR *)SessionVm;
LABEL_19:
    if( !(unsigned int)MiSynchronizeSystemVa((INT64)v18, v9, SystemRegionType, v13, a4) )
      goto LABEL_23;
    v23 = (__int64)(a1 - (_QWORD)MmGetPfnDb()) / 48;
    if( v13 )
    {
      if( !(unsigned int)MiSmallVaStillMapsFrame((PVOID)v9, v23) )
      {
LABEL_22:
        v12 = 2;
LABEL_23:
        MiUnlockStealVm(a4);
        if( (v18[184] & 7) != 3 )
          return v12;
        return 0i64;
      }
    }
    else
    {
      v31 = MI_READ_PTE_LOCK_FREE(v32);
      if( (v31 & 1) == 0 || (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v31) >> 12) & 0xFFFFFFFFFi64) != v23 )
        goto LABEL_22;
    }
    if( ((unsigned int)(*(_DWORD *)(a4 + 48) - 2) <= 1
       || (*(_DWORD *)(a4 + 8) & 0x20) != 0
       || (*(_BYTE *)a1 & 1) != 0 && (*(_BYTE *)(a1 + 35) & 8) == 0)
      && v23 <= 0xFFFFFFFFFi64
      && (*((_QWORD *)MmGetPfnDb() + 6 * v23 + 5) & 0x4000000000000i64) != 0
      && *(UNICODE_STRING **)(qword_140C4E388 + 8 * ((*(_QWORD *)(a1 + 40) >> 39) & 0x3FFi64)) == antNameB )
    {
      LOBYTE(v26) = MI_PFN_IS_PROTO((UNICODE_STRING *)a1, antNameB, 1u, v24);
      if( !v26 )
      {
        IsPfnFileOnly = MiIsPfnFileOnly(v27);
        if( IsPfnFileOnly != v29 && !MiIsPfnFromSlabAllocation(a1) )
          return v30;
      }
    }
    goto LABEL_23;
  }
  return 0i64;
}

Referenced by: