MiLockVadRange

NTSTATUS __stdcall MiLockVadRange(_EPROCESS *Process, VOID *StartingVa, VOID *EndingVa){
  int v3; 
  _ETHREAD *CurrentThread; 
  int v5; 
  VOID *v6; 
  int v8; 
  _MMVAD *Address; 
  __int64 v10; 
  _MMVAD *v11; 
  __int64 v12; 
  unsigned __int64 ExtraCreateInfo; 
  unsigned __int64 v14; 
  unsigned __int64 i; 
  _QWORD *v17; 
  __int64 EndingVpn; 
  _MMVAD_SHORT *v19; 
  _RTL_BALANCED_NODE *Root; 
  _MMVAD_SHORT **v21; 
  __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  _QWORD *v25; 
  unsigned __int64 j; 
  _MMVAD_SHORT *v27; 
  __int128 v28[4]; 
  int v31; 

  v31 = v3;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v28[0] = 0i64;
  v5 = v3;
  v6 = StartingVa;
  v8 = 1;
LABEL_2:
  if( v5 )
    LOCK_ADDRESS_SPACE(CurrentThread, Process);
  else
    LOCK_ADDRESS_SPACE_SHARED(CurrentThread, Process);
  if( !v8 || (Process->Flags & 0x20) != 0 )
  {
    LODWORD(v10) = 0;
    return v10;
  }
  if( v6 == (VOID *)-1i64 )
  {
    Root = Process->VadRoot.Root;
    Address = 0i64;
    while( Root )
    {
      Address = (_MMVAD *)Root;
      Root = Root->Children[0];
    }
  }
  else
  {
    Address = MiLocateAddress(v6);
  }
  v10 = 0i64;
  v11 = Address;
  v12 = 0i64;
  while( v11 )
  {
    ExtraCreateInfo = (unsigned __int64)v11->Core.ExtraCreateInfo;
    v14 = (unsigned __int64)v11;
    if( ExtraCreateInfo )
    {
      v17 = *(_QWORD **)ExtraCreateInfo;
      if( *(_QWORD *)ExtraCreateInfo )
      {
        do
        {
          ExtraCreateInfo = (unsigned __int64)v17;
          v17 = (_QWORD *)*v17;
        }
        while( v17 );
      }
    }
    else
    {
      for( i = v11->Core.VadNode.ParentValue; ; i = *(_QWORD *)(ExtraCreateInfo + 16) )
      {
        ExtraCreateInfo = i & 0xFFFFFFFFFFFFFFFCui64;
        if( !ExtraCreateInfo || *(_QWORD *)ExtraCreateInfo == v14 )
          break;
        v14 = ExtraCreateInfo;
      }
    }
    if( EndingVa != (VOID *)-1i64 )
    {
      EndingVpn = v11->Core.EndingVpn;
      if( (unsigned __int64)EndingVa <= (EndingVpn | ((unsigned __int64)v11->Core.EndingVpnHigh << 32)) << 12 )
      {
        ExtraCreateInfo = 0i64;
        goto LABEL_23;
      }
      if( ExtraCreateInfo )
      {
        if( (EndingVpn | ((unsigned __int64)v11->Core.EndingVpnHigh << 32)) + 1 == (*(unsigned int *)(ExtraCreateInfo + 24) | ((unsigned __int64)*(unsigned __int8 *)(ExtraCreateInfo + 32) << 32)) )
          goto LABEL_23;
        ExtraCreateInfo = 0i64;
      }
      v8 = 0;
    }
LABEL_23:
    if( MiVadIsCfgBitmap(v11) == 1 )
    {
      *((_QWORD *)v28 + v12) = v11;
      v12 = (unsigned int)(v12 + 1);
    }
    else
    {
      if( v10 )
        ExAcquirePushLockExclusiveEx(&v11->Core.PushLock, 0i64);
      else
        MiLockVad(CurrentThread, &v11->Core);
      if( MiVadDeleted(&v11->Core) == 1 || !v8 )
      {
        MiReferenceVad(v19);
        if( Address != v11 )
        {
          do
          {
            v23 = (unsigned __int64)Address->Core.ExtraCreateInfo;
            v24 = (unsigned __int64)Address;
            if( v23 )
            {
              v25 = *(_QWORD **)v23;
              if( *(_QWORD *)v23 )
              {
                do
                {
                  v23 = (unsigned __int64)v25;
                  v25 = (_QWORD *)*v25;
                }
                while( v25 );
              }
            }
            else
            {
              for( j = Address->Core.VadNode.ParentValue; ; j = *(_QWORD *)(v23 + 16) )
              {
                v23 = j & 0xFFFFFFFFFFFFFFFCui64;
                if( !v23 || *(_QWORD *)v23 == v24 )
                  break;
                v24 = v23;
              }
            }
            if( !MiVadIsCfgBitmap(Address) )
            {
              if( (_InterlockedExchangeAdd64(&Address->Core.PushLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
                ExfTryToWakePushLock(&Address->Core.PushLock);
              KeAbPostRelease(&Address->Core.PushLock);
            }
            Address = (_MMVAD *)v23;
          }
          while( (_MMVAD *)v23 != v11 );
        }
        if( v31 )
          UNLOCK_ADDRESS_SPACE_UNORDERED(CurrentThread, Process);
        else
          UNLOCK_ADDRESS_SPACE_SHARED_UNORDERED(CurrentThread, Process);
        if( MiVadDeleted(&v11->Core) == 1 )
          MiWaitForVadDeletion(v27);
        MiUnlockAndDereferenceVad(&v11->Core);
        v5 = v31;
        v6 = StartingVa;
        goto LABEL_2;
      }
      ++v10;
    }
    v11 = (_MMVAD *)ExtraCreateInfo;
  }
  if( v8 == 1 && (_DWORD)v12 )
  {
    v21 = (_MMVAD_SHORT **)v28;
    v22 = (unsigned int)v12;
    do
    {
      if( v10 )
        ExAcquirePushLockExclusiveEx(&(*v21)->PushLock, 0i64);
      else
        MiLockVad(CurrentThread, *v21);
      ++v10;
      ++v21;
      --v22;
    }
    while( v22 );
  }
  return v10;
}

Referenced by: