MmMapViewInSystemCache

NTSTATUS __stdcall MmMapViewInSystemCache(
        VOID *SectionToMap,
        VOID **CapturedBase,
        _LARGE_INTEGER *SectionOffset,
        UINT64 *CapturedViewSize){
  _CONTROL_AREA *v8; 
  _CONTROL_AREA *v9; 
  _BOOL4 v10; 
  int v11; 
  __int64 v12; 
  _SUBSECTION *v13; 
  UINT64 v14; 
  _SUBSECTION *v15; 
  NTSTATUS result; 
  __int64 v17; 
  _WORD *v18; 
  UINT64 v19; 
  INT64 v20; 
  CHAR v21; 
  UINT64 v22; 
  unsigned __int64 Long; 
  int v24; 
  unsigned __int64 v25; 
  int v26; 
  unsigned __int64 v27; 
  int v28; 
  unsigned __int64 v29; 
  int v30; 
  _MMPTE *SubsectionBase; 
  _MMPTE *v32; 
  __int64 PtesInSubsection; 
  UINT64 v34; 
  _MMPTE *v35; 
  _QWORD *v36; 
  __int64 v37; 
  unsigned __int64 v38; 
  unsigned __int64 QuadPart; 
  __int64 v40; 
  __int64 v41; 
  __int64 v42; 
  int v43; 
  __int64 v44; 
  _MMPTE *PteBase; 
  __int64 v46; 
  UINT64 v47; 
  INT64 v48; 
  INT64 v49; 
  int v50[8]; 
  PVOID BugCheckParameter4; 
  UINT64 PteOffset; 
  _QWORD *v53; 
  VOID **v54; 
  _LARGE_INTEGER *v55; 
  _SUBSECTION *v56; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  v55 = SectionOffset;
  v54 = CapturedBase;
  PteOffset = 0i64;
  memset(TbFlushList, 0i64, 0xB8u);
  if( (*((_DWORD *)SectionToMap + 14) & 0x20) != 0 )
    return -1073741688;
  v8 = MiSectionControlArea((_SECTION *)SectionToMap);
  v9 = v8;
  v10 = (*(_DWORD *)CapturedViewSize & 0xFFF) != 0;
  v11 = *(_DWORD *)CapturedViewSize >> 12;
  v12 = (unsigned int)(v10 + v11);
  if( !(v10 + v11) )
    KeBugCheckEx(0x1Au, (PVOID)0x103087, v8, 0i64, 0i64);
  v13 = MiOffsetToProtos(v8, SectionOffset->QuadPart, &PteOffset);
  v14 = v12 + PteOffset;
  v56 = v13;
  v15 = v13;
  result = MiAddViewsForSection(v13, v12 + PteOffset, 5ui64);
  if( result < 0 )
  {
    ++*(&stru_140C4DB30 + 1676);
    return result;
  }
  v17 = v9->u1.Flags._bf_0 & 0x3FF;
  v18 = *(_WORD **)(*(&stru_140C4DB30 + 267) + 8 * v17);
  if( *CapturedBase )
  {
    PteBase = MmGetPteBase();
    v22 = (UINT64)PteBase + (((unsigned __int64)*CapturedBase >> 9) & 0x7FFFFFFFF8i64);
    LODWORD(v46) = MiGetPteLink(*(_QWORD *)(v22 + 24));
    if( v46 == 2 )
    {
      LODWORD(v47) = MiGetPteLink(*(_QWORD *)(v22 + 16));
      if( MiCompareTbFlushTimeStamp(v47, 0xFFFFFui64, v48, v49, (UINT64)BugCheckParameter4) )
      {
        TbFlushList[2] = 20;
        *(_QWORD *)&TbFlushList[6] = 0i64;
        MiInsertTbFlushEntry(
          TbFlushList,
          (VOID *)((__int64)((v22 << 25) - ((_QWORD)PteBase << 25)) >> 16),
          0x40ui64,
          0i64);
        MiFlushTbList(TbFlushList);
      }
    }
  }
  else
  {
    v19 = (UINT64)MiObtainSystemCacheView(*(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v17));
    v22 = v19;
    if( !v19 )
    {
      ++*(&stru_140C4DB30 + 1676);
      MiRemoveSystemCacheReferences(v15, v14, v20, v21);
      return -1073741801;
    }
    *CapturedBase = (VOID *)((__int64)((v19 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16);
  }
  Long = ZeroPte.u.Long;
  LOBYTE(v24) = MiPteInShadowRange(v22);
  if( v24 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
    Long = ZeroPte.u.Long | 0x8000000000000000ui64;
  *(_QWORD *)v22 = Long;
  v25 = ZeroPte.u.Long;
  LOBYTE(v26) = MiPteInShadowRange(v22 + 8);
  if( v26 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
    v25 = ZeroPte.u.Long | 0x8000000000000000ui64;
  *(_QWORD *)(v22 + 8) = v25;
  v27 = ZeroPte.u.Long;
  LOBYTE(v28) = MiPteInShadowRange(v22 + 16);
  if( v28 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
    v27 = ZeroPte.u.Long | 0x8000000000000000ui64;
  *(_QWORD *)(v22 + 16) = v27;
  v29 = ZeroPte.u.Long;
  LOBYTE(v30) = MiPteInShadowRange(v22 + 24);
  if( v30 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
    v29 = ZeroPte.u.Long | 0x8000000000000000ui64;
  *(_QWORD *)(v22 + 24) = v29;
  SubsectionBase = v15->SubsectionBase;
  v32 = &SubsectionBase[PteOffset];
  PtesInSubsection = v15->PtesInSubsection;
  v34 = v22 + 8 * v12;
  v35 = &SubsectionBase[PtesInSubsection];
  LODWORD(v36) = MiGetSystemCacheReverseMap((UINT64)*v54);
  v37 = (__int64)v36;
  v38 = (unsigned __int64)(*v18 & 0x3FF) << 6;
  v53 = v36;
  QuadPart = v55->QuadPart;
  v36[2] &= 0xFFFFFFFFFFFFFFFCui64;
  v40 = v12 & 0x3F | (QuadPart >> 2) & 0x3FFFFFFFFFFF0000i64 | v38;
  v41 = (__int64)v56;
  v36[3] = v56;
  v36[4] = v40;
  if( !v9->FilePointer.Value )
    v36[3] = v41 | 1;
  for( ; v22 < v34; ++v32 )
  {
    if( v32 >= v35 )
    {
      v41 = *(_QWORD *)(v41 + 16);
      v32 = *(_MMPTE **)(v41 + 8);
      v44 = *(unsigned int *)(v41 + 44);
      *(_QWORD *)(v37 + 24) |= 1ui64;
      v35 = &v32[v44];
    }
    v42 = ((_QWORD)v32 << 16) | 0x400i64;
    if( *(&stru_140C4DB30 + 42) )
    {
      if( (*(&stru_140C4DB30 + 42) & v42) != 0 )
        v42 = ((_QWORD)v32 << 16) | 0x410i64;
      else
        v42 |= *(&stru_140C4DB30 + 42);
    }
    LOBYTE(v43) = MiPteInShadowRange(v22);
    if( v43 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v42 & 1) != 0 )
      v42 |= 0x8000000000000000ui64;
    *(_QWORD *)v22 = v42;
    v37 = (__int64)v53;
    v22 += 8i64;
  }
  _InterlockedOr(v50, 0);
  *(_QWORD *)(v37 + 16) = *v54;
  MiManageSubsectionView(v41, v37, (2 * (unsigned __int8)*(_QWORD *)(v37 + 24)) & 2 | 1u);
  return 0;
}

Referenced by: