MmStoreRegister

NTSTATUS __stdcall MmStoreRegister(_EPROCESS *StoreProcess){
  __int64 v1; 
  int v2; 
  int v3; 
  __int64 v4; 
  _QWORD *Pool; 
  INT64 v6; 
  NTSTATUS SystemThread; 
  _RTL_BITMAP *v8; 
  _RTL_BITMAP *v9; 
  unsigned __int64 v10; 
  __int64 *v11; 
  __int64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  UINT64 MaximumSize; 
  _UNICODE_STRING *Pagefile; 
  _UNICODE_STRING *v18; 
  int v19; 
  int v20; 
  UINT64 Flags; 
  UINT64 InternalFlags; 
  _HANDLE Handle[2]; 
  PVOID Object; 

  *(_QWORD *)Handle = 0i64;
  v3 = v2;
  v4 = v1;
  *(&stru_140C50B28 + 265) = 1;
  if( !MmStoreCheckPagefiles() )
    return -1073741497;
  Pool = MiAllocatePool(64i64, 0x28ui64, 0x70546D4Dui64);
  v6 = (INT64)Pool;
  if( !Pool )
    return -1073741670;
  *Pool = &Irp;
  KeInitializeEvent((INT64)(Pool + 1), 0, 0);
  *(_DWORD *)(v6 + 32) = 0;
  SystemThread = PsCreateSystemThreadEx((__int64)Handle, 0x1FFFFF, 0i64, 0i64, 0i64, MiStoreEvictThread, v6, 0i64, 0i64);
  if( SystemThread < 0 )
  {
    ExFreePoolWithTag((PVOID)v6, 0);
  }
  else
  {
    v8 = (_RTL_BITMAP *)MiAllocatePool(
                          64i64,
                          8 * (((unsigned int)MaxIoSize >> 6) + ((MaxIoSize & 0x3F) != 0) + 2),
                          0x20206D4Dui64);
    v9 = v8;
    if( v8 )
    {
      v8->SizeOfBitMap = MaxIoSize;
      v8->Buffer = &v8[1].SizeOfBitMap;
      RtlClearAllBits(v8);
      v10 = 0i64;
      if( *(&stru_140C50B28 + 1708) )
      {
        v11 = (__int64 *)((char *)&stru_140C50B28 + 6840);
        v12 = *(&stru_140C50B28 + 1708);
        do
        {
          v13 = *v11;
          v14 = v10;
          ++v11;
          v10 = *(_QWORD *)(v13 + 8);
          if( v14 >= v10 )
            v10 = v14;
          --v12;
        }
        while( v12 );
      }
      v15 = *(&stru_140C50B28 + 853) + v10;
      MaximumSize = 0xFFFFFFFi64;
      LODWORD(InternalFlags) = 2;
      if( v15 <= 0xFFFFFFF )
        MaximumSize = v15;
      LODWORD(Flags) = 0;
      Pagefile = (_UNICODE_STRING *)MiCreatePagefile(
                                      &Irp,
                                      0i64,
                                      0i64,
                                      MaximumSize,
                                      MaximumSize,
                                      0i64,
                                      Flags,
                                      InternalFlags);
      v18 = Pagefile;
      if( Pagefile )
      {
        MiInsertPageFileInList(Pagefile);
        SystemThread = v19;
        if( v19 < 0 )
        {
          *(_DWORD *)(v6 + 32) = 1;
        }
        else
        {
          Object = 0i64;
          *(&stru_140C50B28 + 146) = v9;
          *(&stru_140C50B28 + 265) = 254;
          v20 = WORD2(v18[12].Buffer) & 0xF;
          *(&stru_140C50B28 + 147) = v4;
          *(&stru_140C50B28 + 263) = v20;
          ObReferenceObjectByHandle(*(VOID **)Handle, 0x1FFFFFui64, (_OBJECT_TYPE *)PsThreadType, 0, &Object, 0i64);
          v9 = 0i64;
          v18 = 0i64;
          *(&stru_140C50B28 + 136) = Object;
          *(&stru_140C50B28 + 296) = v3;
          SystemThread = 0;
          *(&stru_140C50B28 + 264) = 1;
        }
      }
      else
      {
        *(_DWORD *)(v6 + 32) = 1;
        SystemThread = -1073741670;
      }
      if( v9 )
        ExFreePoolWithTag(v9, 0);
      if( v18 )
        MiDeletePagefile((_MMPAGING_FILE *)v18, 1ui64);
    }
    else
    {
      *(_DWORD *)(v6 + 32) = 1;
      SystemThread = -1073741670;
    }
    KeSetEvent((PRKEVENT)(v6 + 8), 0, 0);
    ObCloseHandle(*(VOID **)Handle, 0);
  }
  return SystemThread;
}

Referenced by: