MiGetClusterPage

_MMPFN *__stdcall MiGetClusterPage(
        _MMVAD *Vad,
        VOID *VirtualAddress,
        UINT64 ProtectionCode,
        UINT64 ExistingProtectionCode,
        UINT8 *SuboptimalPage){
  unsigned __int64 v7; 
  _MMSUPPORT_FULL *p_Vm; 
  unsigned __int64 v9; 
  unsigned int v10; 
  __int64 v11; 
  unsigned __int64 v12; 
  unsigned int v13; 
  __int64 v14; 
  char *v15; 
  _MMPTE *v16; 
  __int64 v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  __int64 v24; 
  unsigned __int64 v25; 
  __int64 v26; 
  unsigned __int64 v27; 
  INT64 v28; 
  bool v29; 
  unsigned __int64 v30; 
  int v31; 
  __int64 v32; 
  _MMSUPPORT_INSTANCE *v33; 
  __int64 v34; 
  _MI_PFN_CACHE_ATTRIBUTE v35; 
  unsigned int v36; 
  _KQUEUE *LargePage; 
  unsigned __int64 v39; 
  unsigned __int64 v40; 
  __int64 Alignment; 
  _MI_PFN_CACHE_ATTRIBUTE v42; 
  _MMPFN *PageChain; 
  __int64 v44; 
  bool v45; 
  _LIST_ENTRY **EntryArray; 
  unsigned int ProtectionMask; 
  _MMVAD *Vada; 
  PVOID *Partition; 
  __int64 v50[2]; 
  __int64 v51; 
  INT64 v52; 
  _BYTE *v53; 
  _MI_COLOR_BASE ColorBase[4]; 
  UINT64 v55; 
  UINT64 NumberOfPages; 
  _MI_FAULT_VA_LIST FaultHead[56]; 
  _BYTE *v58; 

  v55 = ProtectionCode;
  ProtectionMask = ExistingProtectionCode;
  v53 = v58;
  *(_OWORD *)ColorBase = 0i64;
  memset(FaultHead, 0i64, 0x60u);
  *v58 = 0;
  v7 = (unsigned __int64)Vad->Core.StartingVpnHigh << 32;
  v51 = 0i64;
  p_Vm = &KeGetCurrentThread()->ApcState.Process->Vm;
  v9 = Vad->Core.StartingVpn | v7;
  Vada = (_MMVAD *)p_Vm;
  v50[0] = (unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFF0000ui64;
  v50[1] = 0x10000i64;
  if( ((unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFF0000ui64) >> 12 < v9
    || (((unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFF0000ui64) + 0xFFFF) >> 12 > (Vad->Core.EndingVpn | ((unsigned __int64)Vad->Core.EndingVpnHigh << 32)) )
  {
    return 0i64;
  }
  v10 = (Vad->Core.u.LongFlags >> 12) & 0x3F;
  MiInitializePageColorBase(&p_Vm->Instance, v10, ColorBase);
  v13 = (unsigned int)ColorBase[3] >> *(&stru_140C4DB30 + 156);
  v29 = (Vad->Core.u.LongFlags & 0x100000) == 0;
  LOWORD(FaultHead[0]) = 2;
  *(_QWORD *)&FaultHead[2] = v50;
  *(_QWORD *)&FaultHead[4] = 1i64;
  *(_QWORD *)&FaultHead[6] = v12;
  *(_QWORD *)&FaultHead[8] = v12;
  if( v29 )
  {
    MiGetProtoPteAddress();
    v18 = v17;
    v19 = *(_QWORD *)(v51 + 8);
    v20 = (((unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFFF000ui64) - v50[0]) >> 12;
    v21 = v19 + 8 * (*(unsigned int *)(v51 + 44) - (unsigned __int64)(*(_DWORD *)(v51 + 52) & 0x3FFFFFFF));
    v22 = v17 & 0xFFFFFFFFFFFFF000ui64;
    if( v22 > v19 )
      v19 = v22;
    v23 = v22 + 4096;
    v15 = (char *)(v18 - 8 * v20);
    if( (unsigned __int64)v15 < v19 )
      return 0i64;
    if( v21 <= v23 )
      v23 = v21;
    if( v18 + 8 * (16 - v20) > v23 )
      return 0i64;
    v16 = (_MMPTE *)((char *)MmGetPteBase() + (((unsigned __int64)v50[0] >> 9) & 0x7FFFFFFFF8i64));
    v14 = *(_WORD *)(*(_QWORD *)v51 + 60i64) & 0x3FF;
    v12 = 0i64;
  }
  else
  {
    v14 = *(unsigned __int16 *)(v11 + 174);
    v15 = (char *)MmGetPteBase() + (((unsigned __int64)v50[0] >> 9) & 0x7FFFFFFFF8i64);
    v16 = (_MMPTE *)(unsigned int)v12;
  }
  v24 = v13;
  v25 = v12;
  Partition = *(PVOID **)(*(&stru_140C4DB30 + 267) + 8 * v14);
  *((_BYTE *)Partition[2] + 4544 * v24 + 3251) = 1;
  do
  {
    LODWORD(v26) = MI_READ_PTE_LOCK_FREE((INT64)&v15[8 * v25]);
    *(_QWORD *)&FaultHead[2 * v25++ + 24] = v26;
  }
  while( v25 < 0x10 );
  v27 = 0i64;
  do
  {
    v28 = *(_QWORD *)&FaultHead[2 * v27 + 24];
    v52 = v28;
    if( (_DWORD)SuboptimalPage )
    {
      IS_PTE_NOT_DEMAND_ZERO();
      if( v31 )
        break;
      v29 = ((v30 >> 5) & 0x1F) == (_DWORD)SuboptimalPage;
    }
    else
    {
      v29 = v28 == 0;
    }
    if( !v29 || v16 && MiIsPteEvaluated(v16, (unsigned int)SuboptimalPage) )
      break;
    if( ++v27 == v55 )
      break;
  }
  while( v27 < 0x10 );
  v32 = -1i64;
  if( v27 == 16 )
  {
    v33 = (_MMSUPPORT_INSTANCE *)Vada;
    LODWORD(v34) = MiComputeZeroClusterMaximum(FaultHead, Vada);
    if( v34 != 16 )
      return 0i64;
    _InterlockedExchangeAdd(*(volatile signed __int32 **)ColorBase, 1u);
    v35 = MiProtectionToCacheAttribute(ProtectionMask);
    LargePage = (_KQUEUE *)MiGetLargePage((INT64)Partition, 2u, v35, v36, 4, 0i64);
    if( LargePage )
    {
      MiConvertEntireLargePageToSmall(LargePage, 2, 2u, (_LARGE_INTEGER *)1, 0i64, 0i64);
      return(_MMPFN *)LargePage;
    }
  }
  else
  {
    v27 = 0i64;
    while( 1 )
    {
      v52 = *(_QWORD *)&FaultHead[2 * v27 + 24];
      if( (v52 & 1) != 0 )
        break;
      if( ++v27 >= 0x10 )
        goto LABEL_33;
    }
    LODWORD(v39) = MI_READ_PTE_LOCK_FREE((INT64)&v52);
    v32 = (v39 >> 12) & 0xFFFFFFFFFi64;
    if( (unsigned __int16)v39 >> 12 != v27 )
      return 0i64;
LABEL_33:
    v33 = (_MMSUPPORT_INSTANCE *)Vada;
  }
  v40 = ((unsigned __int64)VirtualAddress >> 9) & 0x7FFFFFFFF8i64;
  NumberOfPages = 1i64;
  Alignment = ((__int64)(v40 - (((unsigned __int64)v50[0] >> 9) & 0x7FFFFFFFF8i64)) >> 3) & 0xF;
  v42 = MiProtectionToCacheAttribute(ProtectionMask);
  LODWORD(EntryArray) = 258;
  PageChain = MiGetPageChain(Partition, v33, v10, (unsigned int)v42, (UINT64)EntryArray, Alignment, &NumberOfPages);
  if( !PageChain )
    return 0i64;
  v44 = PageChain - MmGetPfnDb();
  if( v27 == 16 )
    v45 = (v44 & 0xF) == Alignment;
  else
    v45 = v32 + ((__int64)(v40 - (((unsigned __int64)v50[0] >> 9) & 0x7FFFFFFFF8i64)) >> 3) - v27 == v44;
  if( !v45 )
    *v53 = 1;
  return PageChain;
}

Referenced by: