MiMapViewOfPhysicalSection

NTSTATUS __stdcall MiMapViewOfPhysicalSection(
        _EPROCESS *Process,
        VOID **CapturedBase,
        _LARGE_INTEGER *SectionOffset,
        UINT64 *CapturedViewSize,
        UINT8 *ProtectionMask,
        UINT64 AllocationType,
        UINT8 *CfgTargetsValid,
        UINT8 *a8){
  int v8; 
  _EPROCESS *v11; 
  unsigned int v12; 
  _ETHREAD *CurrentThread; 
  _MMVAD *Pool; 
  _MMVAD *v15; 
  unsigned int v16; 
  UINT64 v17; 
  UINT64 v18; 
  __int64 LowPart; 
  NTSTATUS inserted; 
  char *v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  int v25; 
  unsigned __int64 v26; 
  INT64 v27; 
  UINT64 v28; 
  int v29; 
  int v30; 
  __int64 v31; 
  __int64 v32; 
  unsigned __int64 v34; 
  int v35; 
  __int64 v36; 
  __int64 v37; 
  int v38; 
  __int64 v39; 
  int v40; 
  UINT64 *HINTHonored; 
  PVOID *v42; 
  __int64 v43; 
  _ETHREAD *Thread; 
  char *v45; 
  UINT64 v46; 
  unsigned __int64 v47; 
  int v48; 

  v8 = (int)CapturedViewSize;
  if( (HIDWORD(Process->Pcb.ThreadListHead.Blink) & 2) != 0 || *(_QWORD *)&Process->Pcb.Affinity.Count )
    return -1073741811;
  v11 = (_EPROCESS *)Process->Pcb.Affinity.Bitmap[0];
  v12 = (unsigned int)CapturedViewSize >> 3;
  if( (unsigned int)CapturedViewSize >> 3 == 2
    || ((unsigned __int8)CapturedViewSize & 5) == 5
    || (_DWORD)CapturedViewSize == 24 )
  {
    return -1073741755;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Thread = CurrentThread;
  Pool = (_MMVAD *)MiAllocatePool(64i64, 0x40ui64, 0x6C646156ui64);
  v15 = Pool;
  if( !Pool )
    return -1073741670;
  Pool->Core.VadNode.ParentValue = -2i64;
  v16 = Pool->Core.u.LongFlags & 0xFFFFF01F;
  v15->Core.PushLock._bf_0 = 0i64;
  v15->Core.u.LongFlags = v16 | ((v8 & 0x1F) << 7) | 0x100010;
  LODWORD(v17) = MiSanitizePage((unsigned __int64)SectionOffset->QuadPart >> 12);
  v47 = -1i64;
  v18 = v17;
  LOCK_ADDRESS_SPACE(CurrentThread, v11);
  if( (v11->Flags & 0x20) != 0 )
  {
    inserted = -1073741558;
  }
  else
  {
    LowPart = (unsigned __int16)SectionOffset->anonymous_0.LowPart;
    if( (Process->Pcb.DeepFreezeStartTime & 1) != 0 )
    {
      v22 = (unsigned __int64)*CapturedBase + LowPart;
      MiIsVaRangeAvailable(v11, (VOID *)v22, (UINT64)Process->Pcb.ProfileListHead.Flink, *(VOID **)Process->Pcb.gap0);
      if( v35 )
      {
LABEL_11:
        v24 = v23 >> 12;
        v25 = 1;
        v26 = (unsigned __int64)v21 >> 12;
        v15->Core.EndingVpnHigh = BYTE4(v26);
        v15->Core.StartingVpnHigh = BYTE4(v24);
        v15->Core.StartingVpn = v24;
        v15->Core.EndingVpn = v26;
        v46 = v18
            + ((unsigned int)v26 | ((unsigned __int64)BYTE4(v26) << 32))
            - ((unsigned int)v24 | ((unsigned __int64)BYTE4(v24) << 32));
        v48 = 1;
        if( v12 == 3 )
        {
          if( (v8 & 7) == 0 )
          {
LABEL_15:
            v43 = -1i64;
            v27 = 0i64;
            v28 = v18;
            if( v18 <= v18
                      + ((unsigned int)v26 | ((unsigned __int64)BYTE4(v26) << 32))
                      - ((unsigned int)v24 | ((unsigned __int64)BYTE4(v24) << 32)) )
            {
              do
              {
                MiIsPfn(v28);
                v30 = v29;
                if( v29 )
                {
                  v32 = v43;
                }
                else
                {
                  v31 = v28;
                  if( v27 )
                    v31 = v43;
                  ++v27;
                  v32 = v31;
                  v43 = v31;
                }
                if( (v28 == v46 || v30 == 1) && v27 )
                {
                  inserted = MiReferenceIoPages(1u, v32, v27, v25, 0i64, 0i64);
                  if( inserted < 0 )
                    goto LABEL_38;
                  v34 = v27 + v43 - 1;
                  v27 = 0i64;
                  v43 = -1i64;
                  v47 = v34;
                }
                v25 = v48;
                ++v28;
              }
              while( v28 <= v46 );
            }
            inserted = MiInsertVadCharges(&v15->Core, (ULONG_PTR)v11);
            if( inserted >= 0 )
            {
              MiInsertViewOfPhysicalSection(v11, v15);
              if( (v8 & 2) != 0 && MiIsProcessCfgEnabled() )
              {
                MiLockVad(Thread, &v15->Core);
                UNLOCK_ADDRESS_SPACE_UNORDERED(Thread, v11);
                v40 = MiCommitVadCfgBits(v15, 0i64, ProtectionMask);
                if( v40 < 0 )
                {
                  MiReferenceVad(&v15->Core);
                  MiDeleteVad(v15, 0i64);
                  return v40;
                }
                MiUnlockVad(Thread, &v15->Core);
              }
              else
              {
                UNLOCK_ADDRESS_SPACE(Thread, v11);
              }
              *CapturedBase = (VOID *)v22;
              return 0;
            }
            goto LABEL_38;
          }
          v25 = 2;
        }
        else if( v12 == 1 )
        {
          v25 = 0;
        }
        v48 = v25;
        goto LABEL_15;
      }
      inserted = -1073741800;
    }
    else
    {
      LODWORD(v42) = 0;
      LODWORD(HINTHonored) = v8;
      v45 = (char *)Process->Pcb.ProfileListHead.Flink + LowPart;
      inserted = MiSelectUserAddress(
                   LODWORD(Process->Pcb.DirectoryTableBase),
                   *(_QWORD *)Process->Pcb.gap0,
                   *(_QWORD *)&Process->Pcb.gap0[8],
                   (UINT64)v45,
                   *(_QWORD *)&Process->Pcb.gap0[16],
                   0i64,
                   HINTHonored,
                   v42);
      if( inserted >= 0 )
      {
        v21 = v45 - 1;
        v22 = (unsigned __int16)SectionOffset->anonymous_0.LowPart;
        v23 = v22;
        goto LABEL_11;
      }
    }
  }
LABEL_38:
  UNLOCK_ADDRESS_SPACE(Thread, v11);
  if( v47 != -1i64 )
  {
    v36 = -1i64;
    v37 = 0i64;
    while( v18 <= v47 )
    {
      MiIsPfn(v18);
      if( !v38 )
      {
        v39 = v18;
        if( v37 )
          v39 = v36;
        ++v37;
        v36 = v39;
      }
      if( v38 == 1 || v18 == v47 )
      {
        if( v37 )
        {
          MiDereferenceIoPages(1i64, v36, v37);
          v36 = -1i64;
          v37 = 0i64;
        }
      }
      ++v18;
    }
  }
  ExFreePoolWithTag(v15, 0);
  return inserted;
}

Referenced by: