MiAllocateNewSubAllocatedRegion

INT64 __fastcall MiAllocateNewSubAllocatedRegion(INT64 a1, UINT64 a2){
  int v2; 
  unsigned __int64 v3; 
  ULONG_PTR v4; 
  __int64 v5; 
  __int64 v6; 
  INT64 v7; 
  unsigned int v8; 
  INT64 ***v9; 
  UINT64 UserReservationHighestAddress; 
  UINT64 ProtectionMask; 
  unsigned __int64 v12; 
  int VadEventBitmap; 
  int v14; 
  unsigned int v15; 
  INT64 *v16; 
  _DWORD *v17; 
  INT64 **v18; 
  INT64 *v19; 
  UINT64 *HINTHonored; 
  PVOID *StartingAddress; 
  unsigned __int64 v23; 
  _ETHREAD *Thread; 
  __int64 v25; 
  int v26; 
  UINT64 v27; 
  INT64 ***v28; 
  v26 = a1;
  v2 = a1;
  Thread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 512i64;
  v4 = *((_QWORD *)Thread + 23);
  v25 = *(_QWORD *)(v4 + 1680);
  if( a2 <= 0x10 )
  {
    LODWORD(v5) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
    v6 = v5;
    if( v5 )
    {
      v7 = 32i64;
      v8 = *(_DWORD *)(v5 + 48) & 0xFFFFF27F;
      *(_QWORD *)(v5 + 16) = -2i64;
      *(_QWORD *)(v5 + 40) = 0i64;
      *(_DWORD *)(v5 + 48) = v8 | 0x100200;
      if( v2 != 1 )
        v7 = 0i64;
      v9 = 0i64;
      UserReservationHighestAddress = MiGetUserReservationHighestAddress(v4, v7);
      ProtectionMask = 0x200000i64;
      do
      {
        LODWORD(StartingAddress) = 0x80000000;
        LODWORD(HINTHonored) = (*(_DWORD *)(v6 + 48) >> 7) & 0x1F;
        v12 = v3 << 12;
        v23 = v3;
        v27 = ProtectionMask;
        VadEventBitmap = MiSelectUserAddress(
                           0i64,
                           0i64,
                           UserReservationHighestAddress,
                           v3 << 12,
                           ProtectionMask,
                           0i64,
                           HINTHonored,
                           StartingAddress);
        if( VadEventBitmap >= 0 )
          break;
        if( ProtectionMask != 0x10000 )
          ProtectionMask = 0x10000i64;
        v3 >>= 1;
        if( v27 != 0x10000 )
          v3 = v23;
      }
      while( v3 >= 0x10 );
      if( v3 >= 0x10 )
      {
        *(_BYTE *)(v6 + 32) = 0;
        *(_BYTE *)(v6 + 33) = (v12 - 1) >> 44;
        *(_DWORD *)(v6 + 24) = 0;
        *(_DWORD *)(v6 + 28) = (v12 - 1) >> 12;
        VadEventBitmap = MiCreateVadEventBitmap(v4, v6, v3, 64);
        if( VadEventBitmap < 0 )
        {
LABEL_28:
          ExFreePoolWithTag((PVOID)v6, 0);
          return(unsigned int)VadEventBitmap;
        }
        v28 = MiLocateVadEvent(v6, 64i64) + 1;
        v15 = ExGenRandom((unsigned int)(v14 - 63));
        v16 = (INT64 *)(v28 + 2);
        v28[4] = (INT64 **)v6;
        v28[2] = 0i64;
        *((_DWORD *)v28 + 12) = v26 & 3 ^ (4 * (v15 % v3));
        v28[3] = 0i64;
        *((_DWORD *)v28 + 10) = 0;
        *((_DWORD *)v28 + 11) = v3;
        v17 = MiAddSecureEntry(v6, 0i64, v12 - 1, -2147483647, 0);
        if( v17 )
        {
          VadEventBitmap = MiInsertVadCharges(v6, v4);
          if( VadEventBitmap >= 0 )
          {
            MiLockVad((__int64)Thread, v6);
            MiInsertPrivateVad(v6, v4);
            MiUnlockVad((__int64)Thread, v6);
            LOCK_PAGE_TABLE_COMMITMENT(Thread, (_EPROCESS *)v4);
            v18 = (INT64 **)(v25 + 16 * (v26 + 20i64));
            v19 = *v18;
            if( (INT64 **)(*v18)[1] != v18 )
              __fastfail(3u);
            *v16 = (INT64)v19;
            v28[3] = v18;
            v19[1] = (INT64)v16;
            *v18 = v16;
            UNLOCK_PAGE_TABLE_COMMITMENT((__int64)Thread, v4);
            v9 = v28;
LABEL_13:
            if( VadEventBitmap >= 0 )
              return(unsigned int)VadEventBitmap;
            goto LABEL_24;
          }
        }
        else
        {
          VadEventBitmap = -1073741670;
        }
        v9 = v28;
LABEL_24:
        if( v9 )
          MiFreeVadEventBitmap((_EPROCESS *)v4, (_MMVAD_SHORT *)v6, 0x40ui64);
        if( v17 )
          ExFreePoolWithTag(v17, 0);
        goto LABEL_28;
      }
      v17 = 0i64;
      goto LABEL_13;
    }
  }
  return 3221225495i64;
}

Referenced by: