MiChargeSegmentCommit

NTSTATUS __stdcall MiChargeSegmentCommit(
        VOID **Subsection,
        _MMPTE *StartingPte,
        UINT64 QuotaCharge,
        UINT64 ChargeAlreadyObtained){
  _ETHREAD *CurrentThread; 
  _MMPTE *v6; 
  _MI_PARTITION *ControlAreaPartition; 
  __int64 v8; 
  __int64 v9; 
  __int64 *v10; 
  __int64 v11; 
  __int64 *v12; 
  _EX_PUSH_LOCK *v13; 
  _EX_PUSH_LOCK *v14; 
  __int64 v15; 
  UINT64 v16; 
  VOID **v17; 
  __int64 v18; 
  _MMPTE *Pml4eBase; 
  _MMPTE *PxeUserLimit; 
  __int64 PteShadow; 
  UINT64 v22; 
  __int64 v23; 
  VOID **v25; 
  __int64 DemandZeroPte; 
  __int64 v27; 
  __int64 v28; 
  unsigned __int64 v29; 
  int v30; 
  __int64 v31; 
  unsigned int *v32; 
  _QWORD *v33; 
  UINT64 NumberOfPages; 
  _CONTROL_AREA *ControlArea; 
  _EX_PUSH_LOCK *Lock; 
  _ETHREAD *v38; 
  VOID **v39; 
  NTSTATUS SubsectionCrossPartitionReferences; 
  _MI_PARTITION *Partition; 
  __int64 v42; 

  v39 = Subsection;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = StartingPte;
  v38 = CurrentThread;
  ControlArea = (_CONTROL_AREA *)*Subsection;
  v42 = *(_QWORD *)*Subsection;
  ControlAreaPartition = MiGetControlAreaPartition(*Subsection, (_EPROCESS *)StartingPte);
  v9 = *(unsigned int *)(v8 + 44);
  Partition = ControlAreaPartition;
  v10 = (__int64 *)v6;
  v33 = (_QWORD *)(v8 + 8);
  v11 = *(_QWORD *)(v8 + 8);
  --CurrentThread->Tcb.SpecialApcDisable;
  v32 = (unsigned int *)(v8 + 44);
  v12 = (__int64 *)(v11 + 8 * v9);
  v14 = v13 + 5;
  Lock = v13 + 5;
  ExAcquirePushLockExclusiveEx(v13 + 5, 0i64);
  v15 = 0i64;
  v16 = 0i64;
  SubsectionCrossPartitionReferences = MiGetSubsectionCrossPartitionReferences((INT64)v39);
  Pml4eBase = MmGetPml4eBase();
  PxeUserLimit = MmGetPxeUserLimit();
  while( 1 )
  {
    PteShadow = *v10;
    if( v10 >= (__int64 *)Pml4eBase && v10 <= (__int64 *)PxeUserLimit )
    {
      PteShadow = MiReadPteShadow((__int64)v10, *v10);
      v17 = v39;
    }
    v22 = v16 + 1;
    if( PteShadow )
      v22 = v16;
    ++v18;
    ++v10;
    v16 = v22;
    if( v18 == QuotaCharge )
      break;
    if( v10 == v12 )
    {
      v17 = (VOID **)v17[2];
      v39 = v17;
      v10 = (__int64 *)v17[1];
      v12 = &v10[*((unsigned int *)v17 + 11)];
    }
  }
  NumberOfPages = v22;
  if( !v22 )
  {
    if( (_InterlockedExchangeAdd64(&v14->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(v14);
    KeAbPostRelease(v14);
    v23 = (__int64)CurrentThread;
LABEL_14:
    KiLeaveGuardedRegionUnsafe(v23);
    return 1;
  }
  if( MiChargeCommit(Partition, v22, 0i64) )
  {
    if( !SubsectionCrossPartitionReferences || MiGetSubsectionCharges((UINT8)v39) >= 0 )
    {
      v25 = Subsection;
      DemandZeroPte = MiMakeDemandZeroPte((*(_BYTE *)(v42 + 14) >> 1) & 0x1F);
      v27 = *v33 + 8i64 * *v32;
      while( 1 )
      {
        LODWORD(v28) = MI_READ_PTE_LOCK_FREE((INT64)v6);
        if( !v28 )
        {
          v29 = DemandZeroPte;
          LOBYTE(v30) = MiPteInShadowRange((UINT64)v6);
          if( v30 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (DemandZeroPte & 1) != 0 )
            v29 = DemandZeroPte | 0x8000000000000000ui64;
          v6->u.Long = v29;
        }
        ++v15;
        ++v6;
        if( v15 == QuotaCharge )
          break;
        if( v6 == (_MMPTE *)v27 )
        {
          v25 = (VOID **)v25[2];
          v6 = (_MMPTE *)v25[1];
          v27 = (__int64)&v6[*((unsigned int *)v25 + 11)];
        }
      }
      MiUpdateProcessSharedCommit(ControlArea, NumberOfPages);
      LODWORD(v31) = MiUpdateControlAreaCommitCount((INT64)ControlArea, NumberOfPages);
      if( SubsectionCrossPartitionReferences && !v31 )
        MiReturnCrossPartitionSectionCharges((_MI_CROSS_PARTITION_CHARGES *)Partition, 0i64, NumberOfPages);
      if( (_InterlockedExchangeAdd64(&Lock->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock(Lock);
      KeAbPostRelease(Lock);
      v23 = (__int64)v38;
      goto LABEL_14;
    }
    MiReturnCommit(Partition, v16);
    if( (_InterlockedExchangeAdd64(&v14->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      goto LABEL_29;
  }
  else if( (_InterlockedExchangeAdd64(&v14->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
  {
LABEL_29:
    ExfTryToWakePushLock(v14);
  }
  KeAbPostRelease(v14);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  return 0;
}

Referenced by: