MiReserveUserMemory
INT64 __fastcall MiReserveUserMemory(INT64 a1, INT64 *a2, INT64 a3, UINT8 r9_0, UINT64 *a5, _WORD *a6){
int v6;
unsigned int v7;
int v10;
__int64 v11;
unsigned __int64 v12;
int v13;
_QWORD *PoolMm;
__int64 v15;
int v16;
int v17;
int v18;
unsigned __int64 v19;
int v20;
int v21;
_ETHREAD *CurrentThread;
int v23;
unsigned int v24;
bool v25;
UINT64 v26;
unsigned int v27;
__int64 v28;
__int64 v29;
__int64 v30;
NTSTATUS v31;
unsigned __int64 v32;
unsigned __int64 v33;
__int64 v34;
int v35;
int v36;
PVOID v37;
INT64 result;
int v39;
int v40;
void *v41;
int v42;
UINT64 v43;
__int64 v44;
unsigned int v45;
unsigned __int64 v46;
INT64 v47;
int v48;
INT64 v49;
int v50;
volatile INT64 *v51;
_MI_VAD_EVENT_BLOCK **ProtectionMask;
UINT64 *HINTHonored;
PVOID *StartingAddress;
NTSTATUS a4;
_ETHREAD *v56;
PVOID P;
PVOID Address;
UINT64 v59;
__int64 v60;
UINT64 StartingVpn;
PVOID Lock;
unsigned int v64;
UINT8 v65;
v65 = r9_0;
v64 = a3;
v6 = 0;
v7 = a3;
a4 = 0;
P = 0i64;
if( a2 == (INT64 *)1 )
return 3221225485i64;
v10 = 16;
v11 = *(_QWORD *)(*(_QWORD *)(a1 + 88) + 1680i64);
if( *(_QWORD *)(a1 + 8) - *(_QWORD *)a1 + 1i64 != *(_QWORD *)(a1 + 24) )
v10 = 0;
if( (*(_DWORD *)(a1 + 44) & 0x88) != 0 )
return 3221225541i64;
if( (*(_DWORD *)(a1 + 60) & 0x20000000) != 0 && (MiFlags & 0x100000) == 0
|| (a3 & 2) == 0
|| (result = MiArbitraryCodeBlocked(*(_QWORD *)(a1 + 96)), a4 = result, (int)result >= 0) )
{
v12 = ((*(_QWORD *)(a1 + 24) & 0xFFFi64) != 0) + (*(_QWORD *)(a1 + 24) >> 12);
LOWORD(v13) = MmGetCurrentProcessorColor();
PoolMm = ExAllocatePoolMm(64i64, 0x40ui64, 0x53646156ui64, v13 | 0x80000000);
v15 = (__int64)PoolMm;
if( !PoolMm )
return 3221225626i64;
v16 = *(_DWORD *)(a1 + 52);
*PoolMm = -2i64;
PoolMm[1] = -2i64;
PoolMm[2] = -2i64;
Lock = PoolMm + 5;
PoolMm[5] = 0i64;
*((_DWORD *)PoolMm + 12) ^= (*((_DWORD *)PoolMm + 12) ^ (v16 << 12)) & 0x3F000;
v17 = *((_DWORD *)PoolMm + 12);
if( v16 )
{
*(_BYTE *)(*(_QWORD *)(*(_QWORD *)(a1 + 88) + 1680i64) + 352i64) = 1;
v17 = *((_DWORD *)PoolMm + 12);
}
v18 = *(_DWORD *)(a1 + 40);
if( (v18 & 0x1000) != 0 )
{
*((_DWORD *)PoolMm + 13) |= 0x80000000;
v19 = v12;
}
else
{
v19 = 0i64;
}
v20 = *(_DWORD *)(a1 + 60);
*((_DWORD *)PoolMm + 12) = v17 ^ ((unsigned __int16)v17 ^ (unsigned __int16)((_WORD)v7 << 7)) & 0xF80 | 0x100000;
if( (v20 & 0x40000000) != 0 )
*((_DWORD *)PoolMm + 12) = v17 ^ ((unsigned __int16)v17 ^ (unsigned __int16)((_WORD)v7 << 7)) & 0xF80 | 0x4100000;
if( (v20 & 1) != 0 )
{
v19 = 0x7FFFFFFFEi64;
}
else if( (v20 & 0x8000000) != 0 )
{
v19 = 0x7FFFFFFFDi64;
}
v21 = (*((_DWORD *)PoolMm + 13) ^ v19) & 0x7FFFFFFF;
*(_BYTE *)(v15 + 34) = v19 >> 31;
*(_DWORD *)(v15 + 52) ^= v21;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v23 = v18 & 0x20400000;
v56 = CurrentThread;
if( (v18 & 0x20400000) == 0x20000000 )
{
v46 = *(_QWORD *)(a1 + 120);
v6 = (v46 >> 4) & 1 | 2;
}
else
{
if( v23 != 541065216 )
{
if( v23 != 0x400000 )
{
if( (v18 & 0x800000) == 0 )
goto LABEL_21;
if( !(unsigned int)MiCreateRotateView(v15) )
{
v31 = -1073741670;
LOBYTE(v27) = v10;
goto LABEL_74;
}
v45 = *(_DWORD *)(v15 + 48) & 0xFFFFFF8F | 0x40;
goto LABEL_69;
}
v48 = v7 & 7;
if( (v7 & 0xFFFFFFF8) != 16 && (v48 == 4 || v48 == 1) )
{
v49 = v7;
if( (*(_BYTE *)(a1 + 120) & 1) == 0 )
{
LABEL_111:
a4 = MiCreateUserPhysicalView(v15, v49, a1, a6);
if( a4 < 0 )
{
v31 = -1073741670;
LOBYTE(v27) = v10;
goto LABEL_74;
}
v45 = *(_DWORD *)(v15 + 48) & 0xFDFFFF8F | 0x30;
LABEL_69:
*(_DWORD *)(v15 + 48) = v45;
goto LABEL_21;
}
if( *(_QWORD *)(a1 + 112) )
{
v50 = *(_DWORD *)(a1 + 48);
v49 = v7 | 2;
if( (v50 & 0x1C000) == 0 )
v49 = v7;
if( (v50 & 0x12000) != 0 )
v49 = v49 & 0xFFFFFFFA | 4;
goto LABEL_111;
}
}
v31 = -1073741755;
LOBYTE(v27) = v10;
goto LABEL_75;
}
v46 = *(_QWORD *)(a1 + 120);
v6 = 1;
if( (v46 & 2) == 0 )
{
LABEL_21:
v24 = (v6 << 18) | *(_DWORD *)(v15 + 48) & 0xFFF3FFFF;
v25 = (*(_DWORD *)(a1 + 40) & 0x200000) == 0;
*(_DWORD *)(v15 + 48) = v24;
if( !v25 )
{
a4 = MiCreateWriteWatchView(*(_QWORD *)(a1 + 88), v15);
v31 = a4;
LOBYTE(v27) = v10;
if( a4 < 0 )
goto LABEL_74;
*(_DWORD *)(v15 + 48) |= 0x200000u;
v24 = *(_DWORD *)(v15 + 48);
v7 = v64;
}
if( (*(_BYTE *)(a1 + 120) & 1) != 0 )
{
if( (*(_DWORD *)(a1 + 40) & 0x20400000) == 0x400000 || (v24 & 0x500000) == 5242880 )
{
if( *(_DWORD *)(a1 + 48) )
{
LABEL_24:
v26 = 0i64;
v27 = v10;
v25 = (*(_DWORD *)(a1 + 60) & 0x4000000) == 0;
Address = 0i64;
if( !v25 )
{
a4 = MiCreatePlaceholderStorage(v15);
v31 = a4;
if( a4 < 0 )
goto LABEL_71;
v7 = v64;
v27 = v10 | 8;
}
v28 = (__int64)v56;
v29 = *(_QWORD *)(a1 + 88);
v59 = 0i64;
v27 |= 4u;
LOCK_ADDRESS_SPACE((__int64)v56, v29);
v30 = *(_QWORD *)(a1 + 88);
if( (*(_DWORD *)(v30 + 1124) & 0x20) != 0 )
{
v31 = -1073741558;
goto LABEL_72;
}
if( v27 < 0x10 )
{
LODWORD(StartingAddress) = *(_DWORD *)(a1 + 60);
LODWORD(HINTHonored) = v7;
v31 = MiSelectUserAddress(
*(unsigned int *)(a1 + 40),
*(_QWORD *)a1,
*(_QWORD *)(a1 + 8),
*(_QWORD *)(a1 + 24),
*(_QWORD *)(a1 + 16),
0i64,
HINTHonored,
StartingAddress);
if( v31 >= 0 )
{
v26 = (UINT64)Address;
v32 = (unsigned __int64)Address + *(_QWORD *)(a1 + 24) - 1;
goto LABEL_29;
}
MiLogReserveVaFailed(*(_QWORD *)(a1 + 24), *(_QWORD *)(a1 + 16), *(_QWORD *)a1, *(_QWORD *)(a1 + 8));
v26 = (UINT64)Address;
LABEL_72:
*a5 = v26;
if( P )
MiUnlockVad(v28, (__int64)P);
goto LABEL_74;
}
if( (*(_DWORD *)(a1 + 60) & 0x4000000) != 0 )
{
P = MiFindPlaceholderVadToReplace(
*(_QWORD *)a1,
*(_QWORD *)(a1 + 8),
*(unsigned __int8 *)(a1 + 104),
&a4);
if( !P )
{
v31 = a4;
goto LABEL_72;
}
v41 = *(void **)a1;
v32 = *(_QWORD *)(a1 + 8);
LABEL_60:
v26 = (UINT64)v41;
Address = v41;
LABEL_29:
v33 = v32 >> 12;
StartingVpn = v26 >> 12;
*(_DWORD *)(v15 + 24) = v26 >> 12;
*(_BYTE *)(v15 + 32) = v26 >> 44;
v25 = (*(_BYTE *)(a1 + 120) & 1) == 0;
*(_DWORD *)(v15 + 28) = v33;
*(_BYTE *)(v15 + 33) = BYTE4(v33);
if( v25 )
{
a4 = MiInsertVadCharges(v15, *(_QWORD *)(a1 + 88));
v31 = a4;
if( a4 >= 0 )
{
if( P )
{
LOBYTE(v27) = v27 | 1;
MiPreparePlaceholderVadReplacement((__int64)P, *(_QWORD *)(a1 + 88), v11 + 48);
ExAcquirePushLockExclusiveEx(v15 + 40, 0i64);
v34 = (__int64)v56;
}
else
{
v34 = (__int64)v56;
MiLockVad((__int64)v56, v15);
}
MiInsertPrivateVad(v15, *(_QWORD *)(a1 + 88));
if( (v64 & 2) != 0 && MiIsProcessCfgEnabled() )
LOBYTE(v27) = 2;
v35 = v27 & 2;
if( !v35 )
{
v36 = *(_DWORD *)(v15 + 48);
if( ((v36 & 0x100000) == 0 || (v36 & 0x400000) == 0 && (v36 & 0xC0000u) < 0x80000)
&& !*(_QWORD *)(a1 + 80) )
{
v37 = P;
if( !P )
{
MiUnlockVad(v34, v15);
UNLOCK_ADDRESS_SPACE(v34, *(_QWORD *)(a1 + 88));
LABEL_41:
*a5 = v26;
return 0i64;
}
v51 = (volatile INT64 *)Lock;
if( (_InterlockedExchangeAdd64((volatile signed __int64 *)Lock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock(v51);
KeAbPostRelease((PVOID)v51);
UNLOCK_ADDRESS_SPACE_UNORDERED(v34, *(_QWORD *)(a1 + 88));
v26 = (UINT64)Address;
goto LABEL_143;
}
}
UNLOCK_ADDRESS_SPACE_UNORDERED(v34, *(_QWORD *)(a1 + 88));
MiReferenceVad(v15);
if( v35 && (v39 = MiCommitVadCfgBits(v15, 0i64, &v65), v39 < 0)
|| (v40 = *(_DWORD *)(v15 + 48), (v40 & 0x100000) != 0)
&& ((v40 & 0x400000) != 0 || (v40 & 0xC0000u) >= 0x80000)
&& *(int *)(v15 + 52) < 0
&& (v39 = MiMapUserLargePages(v15), v39 < 0) )
{
MiDeleteVad((_MMVAD *)v15, (UINT64)P);
return(unsigned int)v39;
}
if( !*(_QWORD *)(a1 + 80) )
{
LABEL_54:
v37 = P;
if( !P )
{
MiUnlockAndDereferenceVad((PVOID)v15);
goto LABEL_41;
}
MiUnlockAndDereferenceNestedVad((PVOID)v15);
LABEL_143:
MiFinishPlaceholderVadReplacement(v37);
goto LABEL_41;
}
v43 = *(unsigned int *)(a1 + 76);
v25 = (*(_DWORD *)(a1 + 60) & 0x40000000) == 0;
v60 = 0i64;
if( v25 )
{
if( (_DWORD)v43 != -2147483647 && (unsigned int)(v43 - 1) > 1 && (_DWORD)v43 != 4 )
{
v31 = -1073741755;
goto LABEL_141;
}
LODWORD(ProtectionMask) = 0;
v31 = MiSecureVad((_MMVAD_SHORT *)v15, (PVOID)v26, *(_QWORD *)(a1 + 24), v43, ProtectionMask);
if( v31 >= 0 )
{
v44 = v60;
LABEL_65:
**(_QWORD **)(a1 + 80) = qword_140C4DB90 ^ *(_QWORD *)(a1 + 88) ^ v44;
goto LABEL_54;
}
}
else
{
v44 = (__int64)MiAddSecureEntry(
v15,
(*(unsigned int *)(v15 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 32) << 32)) << 12,
((*(unsigned int *)(v15 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 33) << 32)) << 12) | 0xFFF,
v43,
1);
if( v44 )
goto LABEL_65;
v31 = -1073741670;
}
LABEL_141:
MiDeleteVad((_MMVAD *)v15, (UINT64)P);
return(unsigned int)v31;
}
}
else
{
MiStoreGraphicsProtectionInVad(v15, *(unsigned int *)(a1 + 48));
v31 = -1073741637;
}
goto LABEL_71;
}
v32 = *(_QWORD *)(a1 + 8);
HIDWORD(ProtectionMask) = HIDWORD(v32);
MiIsVaRangeAvailable((_EPROCESS *)v30, *(VOID **)a1, *(_QWORD *)(a1 + 24), *(VOID **)a1);
if( v42 )
goto LABEL_60;
v31 = -1073741800;
LABEL_71:
v28 = (__int64)v56;
goto LABEL_72;
}
v31 = -1073741755;
LOBYTE(v27) = v10;
}
else
{
v31 = -1073741637;
LOBYTE(v27) = v10;
}
}
else
{
if( !*(_DWORD *)(a1 + 48) )
goto LABEL_24;
v31 = -1073741755;
LOBYTE(v27) = v10;
}
LABEL_74:
CurrentThread = v56;
LABEL_75:
if( (v27 & 4) != 0 )
UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, *(_QWORD *)(a1 + 88));
MiReleaseVadEventBlocks(v15, 0);
ExFreePoolWithTag((PVOID)v15, 0);
return(unsigned int)v31;
}
}
if( (v46 & 4) != 0 )
{
if( (v46 & 0x1A) == 0
|| (!a2 ? (MiGetProcessPartition(*(_EPROCESS **)(a1 + 88)), CurrentThread = v56) : (_ETHREAD *)(v47 = *a2),
(*(_DWORD *)(v47 + 4) & 0x40) == 0) )
{
v31 = -1073741811;
LOBYTE(v27) = v10;
goto LABEL_75;
}
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, *(_BYTE *)(a1 + 104)) )
{
v31 = -1073741727;
LOBYTE(v27) = v10;
goto LABEL_74;
}
*(_DWORD *)(v15 + 48) |= 0x800000u;
}
a4 = MiCreateLargePageVad(*(_EPROCESS **)(a1 + 88), (_MMVAD_SHORT *)v15);
v31 = a4;
LOBYTE(v27) = v10;
if( a4 < 0 )
goto LABEL_74;
if( a2 )
*a6 = *(_WORD *)*a2;
v7 = v64;
if( (*(_BYTE *)(a1 + 120) & 0x1A) != 0 )
*(_DWORD *)(v15 + 48) |= 0x400000u;
goto LABEL_21;
}
return result;
}Referenced by:
MiAllocateVirtualMemory