MiMarkSharedImageCfgBits

VOID __fastcall MiMarkSharedImageCfgBits(_MI_CFG_BITMAP_INFO *BitMapInfo, INT64 ListType, _MMVAD *Vad){
  _MI_CFG_BITMAP_INFO *v3; 
  _LARGE_INTEGER **Subsection; 
  _EPROCESS *Process; 
  __int64 v6; 
  __int64 v7; 
  _MMVAD *v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  volatile signed __int64 *p_bf_0; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  INT64 v16; 
  INT64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  int v21; 
  VOID *v22; 
  unsigned __int64 v23; 
  unsigned int v24; 
  UINT64 NewProtect; 
  _MI_CFG_COPY_TO_BITMAP_ITERATOR *CopyIterator; 
  UINT64 *CapturedOldProtect; 
  UINT64 AnyPageLocked; 
  _EPROCESS *v29; 
  _MMVAD *DestinationVad; 
  _MI_CFG_BITMAP_INFO *v31; 
  _MI_CFG_COPY_TO_BITMAP_OPTION CopyOption[4]; 
  int v33; 

  AnyPageLocked = 0i64;
  v3 = BitMapInfo;
  v31 = BitMapInfo;
  Subsection = (_LARGE_INTEGER **)Vad->Subsection;
  Process = KeGetCurrentThread()->ApcState.Process;
  v29 = Process;
  LODWORD(v6) = MiGetControlAreaLoadConfig(*Subsection);
  v8 = (_MMVAD *)*((_QWORD *)v3 + 2);
  v9 = (unsigned __int64)*(unsigned __int8 *)(v7 + 33) << 32;
  v10 = (unsigned __int64)*(unsigned __int8 *)(v7 + 32) << 32;
  DestinationVad = *(_MMVAD **)(v6 + 16);
  p_bf_0 = &v8->Core.PushLock._bf_0;
  v12 = (*(unsigned int *)(v7 + 24) | v10) << 12;
  v13 = 2 * (((((*(unsigned int *)(v7 + 28) | v9) + 1) << 12) - v12) >> 4);
  v14 = *(_QWORD *)v3 + ((2 * (v12 >> 4)) >> 3);
  v15 = v13 >> 3;
  ExAcquirePushLockExclusiveEx(&v8->Core.PushLock, 0i64);
  if( !MiVadDeleted(&v8->Core) )
  {
    v18 = v15 + v14;
    v33 = 0;
    v19 = (v15 + v14 - 1) | 0xFFF;
    v20 = v14 & 0xFFFFFFFFFFFFF000ui64;
    *(_OWORD *)CopyOption = 0i64;
    while( 1 )
    {
      if( v20 > v19 )
      {
LABEL_10:
        if( (_InterlockedExchangeAdd64(p_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock(&v8->Core.PushLock);
        KeAbPostRelease(&v8->Core.PushLock);
        return;
      }
      MiIsCfgBitMapPageShared((VOID *)v20, v8, v16, v17, NewProtect);
      if( v21 == 2 )
        break;
      if( v21 != 1 )
      {
        if( v21 == 3 )
        {
          v22 = (VOID *)v19;
          if( (v20 | 0x1FFFFF) <= v19 )
            v22 = (VOID *)(v20 | 0x1FFFFF);
LABEL_6:
          LODWORD(CopyIterator) = 0;
          LODWORD(NewProtect) = 2;
          if( MiSetProtectionOnSection(
                 (ULONG_PTR)Process,
                 v8,
                 (VOID *)v20,
                 v22,
                 NewProtect,
                 (UINT64)CopyIterator,
                 (UINT64 *)((char *)&AnyPageLocked + 4),
                 &AnyPageLocked) < 0 )
            goto LABEL_10;
          v20 = (unsigned __int64)v22 - 4095;
          v3 = v31;
        }
        else
        {
          if( v20 < v14 )
            v23 = (unsigned int)(v14 - v20);
          else
            v23 = 0i64;
          if( v20 + 4096 <= v18 )
          {
            v24 = 4096 - v23;
          }
          else
          {
            v24 = v18 - v20 - v23;
            if( (_DWORD)v18 - (_DWORD)v20 == (_DWORD)v23 )
              goto LABEL_10;
          }
          LODWORD(CapturedOldProtect) = (unsigned int)(v23 + v20 - v14) >> 1 << 7;
          if( MiCopyToCfgBitMap(
                 v3,
                 DestinationVad,
                 (VOID *)v23,
                 MiRvaListDefault,
                 v20 + (unsigned int)v23,
                 (_MI_CFG_COPY_TO_BITMAP_ITERATOR *)v8,
                 (UINT64)CapturedOldProtect,
                 (_MI_CFG_COPY_TO_BITMAP_OPTION)CopyOption,
                 v24) < 0 )
            goto LABEL_10;
        }
        LODWORD(Process) = (_DWORD)v29;
      }
      v20 += 4096i64;
    }
    v22 = (VOID *)(v20 | 0xFFF);
    goto LABEL_6;
  }
  if( (_InterlockedExchangeAdd64(p_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&v8->Core.PushLock);
  KeAbPostRelease(&v8->Core.PushLock);
}

Referenced by: