MiCopyHeaderIfResident

NTSTATUS __stdcall MiCopyHeaderIfResident(_FILE_OBJECT *File, ULONG_PTR ImagePageFrameNumber){
  UINT64 v2; 
  unsigned __int64 v4; 
  _SECTION_OBJECT_POINTERS *SectionObjectPointer; 
  INT64 *DataSectionObject; 
  UINT64 v8; 
  INT64 v9; 
  int v10; 
  UINT64 v11; 
  unsigned __int64 v12; 
  int v13; 
  __int64 v14; 
  _MMPFN *v15; 
  UINT64 v16; 
  __int64 ProtoPagePfn; 

  v2 = *(_QWORD *)&ImagePageFrameNumber;
  ProtoPagePfn = 0i64;
  v16 = 0i64;
  while( 1 )
  {
    v4 = (unsigned __int8)ExAcquireSpinLockExclusive(&SpinLock);
    SectionObjectPointer = File->SectionObjectPointer;
    if( !SectionObjectPointer || (DataSectionObject = (INT64 *)SectionObjectPointer->DataSectionObject) == 0i64 )
    {
      ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
LABEL_5:
      __writecr8(v4);
      return 0;
    }
    if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel(DataSectionObject + 9) )
      break;
    ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
    __writecr8(v4);
  }
  ExReleaseSpinLockExclusiveFromDpcLevel(&SpinLock);
  if( (DataSectionObject[7] & 3) != 0
    || (v9 = DataSectionObject[17]) == 0
    || (int)MiTryLockProtoPoolPageAtDpc((_MMPTE *)DataSectionObject[17], v8) < 0 )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
    goto LABEL_5;
  }
  if( (MEMORY[0x22] & 0x20) != 0 )
    goto LABEL_28;
  if( (MEMORY[0x22] & 0xC0) != 64 )
    goto LABEL_28;
  if( (MEMORY[0x23] & 0x40) != 0 )
    goto LABEL_28;
  LOBYTE(v10) = MiIsPageOnBadList(0i64);
  if( v10 )
    goto LABEL_28;
  LODWORD(v11) = MI_READ_PTE_LOCK_FREE(v9);
  v16 = v11;
  v12 = v11;
  if( (v11 & 1) != 0 )
  {
    MiPteInShadowRange((UINT64)&v16);
    v13 = 0;
  }
  else
  {
    if( *(&stru_140C4DB30 + 42) )
    {
      if( (v11 & 0x10) != 0 )
        v12 = v11 & 0xFFFFFFFFFFFFFFEFui64;
      else
        v12 = ~*(&stru_140C4DB30 + 42) & v11;
    }
    v13 = 1;
  }
  v14 = (v12 >> 12) & 0xFFFFFFFFFi64;
  v15 = &MmGetPfnDb()[v2];
  if( _interlockedbittestandset64((volatile signed __int32 *)&v15->u2, 0x3Fui64) )
  {
LABEL_28:
    ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
    __writecr8(2ui64);
    _InterlockedAnd64((volatile signed __int64 *)0x18, 0x7FFFFFFFFFFFFFFFui64);
    MiUnlockProtoPoolPage(ProtoPagePfn, v4);
    return 0;
  }
  MiCopyPage(v2, v14, 0i64, 4ui64);
  ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
  __writecr8(2ui64);
  if( v13 == 1 )
    MiUpdatePageAttributeStamp(0i64);
  _InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  _InterlockedAnd64((volatile signed __int64 *)0x18, 0x7FFFFFFFFFFFFFFFui64);
  MiUnlockProtoPoolPage(ProtoPagePfn, v4);
  return 1;
}

Referenced by: