MiCloneVads
__int64 __fastcall MiCloneVads(__int64 a1, ULONG_PTR a2, __int64 a3, __int64 a4, int a5, _DWORD *a6){
_QWORD *CurrentProcess;
__int64 v8;
__int64 v9;
__int64 *v10;
unsigned __int64 v11;
int v12;
__int64 v13;
__int64 v14;
INT64 v15;
INT64 *SharedVm;
KIRQL v17;
__int64 v18;
INT64 *v19;
unsigned __int64 j;
__int64 v21;
int v22;
__int64 *v23;
_QWORD *v24;
_QWORD *v25;
_QWORD **v26;
INT64 v27;
_QWORD *v28;
_QWORD *v29;
_QWORD *v30;
UINT64 v31;
RTL_BALANCED_NODE *Address;
__int64 v33;
unsigned __int64 v34;
__int64 v35;
ULONG_PTR v36;
unsigned __int64 v37;
INT64 *v38;
INT64 *v39;
int v40;
unsigned __int64 updated;
int v42;
unsigned __int64 v43;
bool v44;
__int64 v45;
unsigned __int64 v46;
unsigned __int64 v47;
INT64 v48;
INT64 ***LockedVadEvent;
__int64 v50;
UINT64 v51;
__int64 v52;
__int64 *v53;
_QWORD *i;
unsigned __int64 v55;
unsigned __int64 v56;
__int64 v57;
_QWORD **v58;
unsigned __int64 v59;
_QWORD *v60;
INT64 *v61;
unsigned __int64 v62;
__int64 v63;
CHAR WsIrql;
UINT64 SpinCount;
int v67;
INT64 a1a;
unsigned __int64 v69;
__int64 *v70;
_QWORD *v71;
INT64 a4a;
INT64 v73;
__int64 *v74;
unsigned __int64 v75;
_QWORD *v76;
__int64 v77;
_QWORD *v78;
unsigned __int64 v79;
__int64 v80;
__int64 v81;
_QWORD *v82;
_DWORD *v83;
INT64 result[10];
__int128 v85;
int v86;
__int16 v87;
int v88;
__int64 v89;
__int64 v90;
v73 = a3;
CurrentProcess = (_QWORD *)a1;
v82 = (_QWORD *)a1;
v77 = a4;
v83 = a6;
memset((INT64)result, 0i64);
memset((INT64)&v86, 0i64);
v67 = 0;
a4a = 0i64;
v75 = 0i64;
v69 = 0i64;
v85 = 0i64;
v8 = 0i64;
a1a = (INT64)KeGetCurrentThread();
while( 1 )
{
v9 = CurrentProcess[159];
if( !v9 )
v9 = 1i64;
v74 = MiBuildNewCloneDescriptor((ULONG_PTR)CurrentProcess, v9, *(_QWORD *)(CurrentProcess[210] + 360i64));
v10 = v74;
if( !v74 )
return 3221225626i64;
v11 = 32 * (v9 + 1);
v12 = PsChargeProcessNonPagedPoolQuota(a2, v11);
if( v12 < 0 )
{
v22 = v12;
goto LABEL_90;
}
LODWORD(v13) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v80 = v13;
v14 = v13;
if( !v13 )
{
PsReturnProcessNonPagedPoolQuota(a2, v11);
v22 = -1073741670;
LABEL_90:
MiFreeCloneDescriptor((INT64)CurrentProcess, (INT64)v74);
return(unsigned int)v22;
}
v15 = a1a;
*(_QWORD *)(v13 + 64) = v11;
MiLockAweVadsExclusive(v15);
SharedVm = MiGetSharedVm((INT64)(CurrentProcess + 208));
v17 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
*((_DWORD *)SharedVm + 1) = 0;
WsIrql = v17;
if( CurrentProcess[159] <= (unsigned __int64)v10[5] )
{
v18 = a1a;
*(_QWORD *)v14 = v73;
CurrentProcess[156] = v18;
MiUnlockWorkingSetExclusive((INT64)(CurrentProcess + 208), v17);
MiUnlockAweVadsExclusive(v18);
v19 = MiGetSharedVm((INT64)(CurrentProcess + 208));
ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v19);
j = 0i64;
*((_DWORD *)v19 + 1) = 0;
v21 = v10[3];
v81 = v21;
if( MiInitializeForkMaps(a2, (INT64)result) )
{
v23 = (__int64 *)v21;
v70 = (__int64 *)v21;
v10[6] = 1i64;
MiInsertClone((__int64)CurrentProcess, v10, 1);
v24 = *(_QWORD **)(a2 + 2008);
v86 = 1;
v25 = 0i64;
v87 = 0;
v89 = 0i64;
v88 = 20;
v90 = 0i64;
while( v24 )
{
v25 = v24;
v24 = (_QWORD *)*v24;
}
if( v25 )
{
do
{
v26 = (_QWORD **)v25[1];
v27 = (INT64)v25;
v78 = v25;
v28 = v25;
v76 = v25;
if( v26 )
{
v29 = *v26;
v25 = v26;
v71 = v26;
if( v29 )
{
do
{
v30 = (_QWORD *)*v29;
v25 = v29;
v71 = v29;
v29 = v30;
}
while( v30 );
}
}
else
{
v25 = (_QWORD *)(v25[2] & 0xFFFFFFFFFFFFFFFCui64);
v71 = v25;
if( v25 )
{
do
{
if( (_QWORD *)*v25 == v28 )
break;
v28 = v25;
v25 = (_QWORD *)(v25[2] & 0xFFFFFFFFFFFFFFFCui64);
}
while( v25 );
v71 = v25;
}
}
v31 = (*(unsigned int *)(v27 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v27 + 32) << 32)) << 12;
Address = MiLocateAddress(v31);
v33 = *(unsigned int *)(v27 + 52);
LODWORD(v33) = v33 & 0x7FFFFFFF;
v34 = (unsigned __int64)*(unsigned __int8 *)(v27 + 34) << 31;
v73 = (INT64)Address;
if( (v33 | v34) < 0x7FFFFFFFDi64 && !MiIsVadLargePrivate(v27) )
{
v36 = v35 + ((v31 >> 9) & 0x7FFFFFFFF8i64);
v37 = v35
+ 8
* ((*(unsigned int *)(v27 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v27 + 33) << 32)) & 0xFFFFFFFFFi64);
v79 = v37;
do
{
MiFlushTbList((__int64)&v86);
if( MiWorkingSetIsContended((INT64)(CurrentProcess + 208)) || KeShouldYieldProcessor() )
{
LODWORD(SpinCount) = 0;
v38 = MiGetSharedVm((INT64)(CurrentProcess + 208));
v39 = v38;
if( (*(_DWORD *)v38 & 0x40000000) != 0 )
{
HIDWORD(SpinCount) = 1;
*((_DWORD *)v38 + 1) = 1;
}
else
{
HIDWORD(SpinCount) = 0;
}
MiUnlockWorkingSetExclusive((INT64)(CurrentProcess + 208), WsIrql);
v40 = 0;
if( HIDWORD(SpinCount) )
{
LODWORD(SpinCount) = 0;
while( *((_DWORD *)v39 + 1) )
{
KeYieldProcessorEx(&SpinCount);
if( (SpinCount & 0x3F) == 0 )
{
v40 = 1;
break;
}
}
}
ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v39);
if( !v40 )
*((_DWORD *)v39 + 1) = 0;
v23 = v70;
}
updated = MiUpdateForkMaps(result, v36, v37, (INT64)&a4a, (INT64)CurrentProcess, WsIrql);
v42 = *(_DWORD *)(v27 + 48);
v36 = updated;
if( (*(_BYTE *)(v27 + 48) & 0x70) != 80 )
{
if( updated > v37 )
break;
v43 = v37;
v44 = (updated & 0xFFFFFFFFFFFFF000ui64) + 4088 <= v37;
v45 = result[8];
if( v44 )
v43 = (updated & 0xFFFFFFFFFFFFF000ui64) + 4088;
v46 = result[5] - updated;
v47 = v43;
do
{
if( MiBuildForkPte(
(__int64)CurrentProcess,
a2,
v36,
(__int64 *)(v46 + v36),
v77,
v23,
&a4a,
v45,
(__int64)&v86,
v73,
(__int64)v76,
a5,
WsIrql,
&v85,
&v67) )
{
v23 += 4;
}
v36 += 8i64;
}
while( v36 <= v47 );
v37 = v79;
v27 = (INT64)v78;
v70 = v23;
v42 = *((_DWORD *)v78 + 12);
}
}
while( v36 <= v37 );
v25 = v71;
if( (v42 & 0x300000) == 3145728 )
{
MiLocateLockedVadEvent(v27, 4i64);
LockedVadEvent = MiLocateLockedVadEvent(v73, v48);
memmove(*(UINT8 **)(v50 + 16), (UINT8 *)LockedVadEvent[2], v51);
}
}
j = 0i64;
}
while( v25 );
v14 = v80;
v10 = v74;
}
MiFlushTbList((__int64)&v86);
MiFreeForkMaps((INT64)result);
v52 = (__int64)v23 - v81;
v53 = (__int64 *)v10[7];
*(_QWORD *)(a2 + 1272) += a4a;
v8 = v52 >> 5;
a4a = *(_QWORD *)(a2 + 1272);
if( v8 )
{
*v53 = v8;
v10[6] = v8;
v10[5] = v8;
}
else
{
RtlAvlRemoveNode(CurrentProcess + 158, v10);
}
for( i = (_QWORD *)CurrentProcess[158]; i; i = (_QWORD *)*i )
j = (unsigned __int64)i;
if( j )
{
v55 = v69;
v56 = v75;
do
{
if( *(_QWORD *)(j + 48) )
{
_InterlockedIncrement64((volatile signed __int64 *)(*(_QWORD *)(j + 56) + 8i64));
v57 = *(_QWORD *)v14;
v55 += *(_QWORD *)(v14 + 64);
v56 += *(_QWORD *)(j + 64);
*(_OWORD *)v14 = *(_OWORD *)j;
*(_OWORD *)(v14 + 16) = *(_OWORD *)(j + 16);
*(_OWORD *)(v14 + 32) = *(_OWORD *)(j + 32);
*(_OWORD *)(v14 + 48) = *(_OWORD *)(j + 48);
*(_OWORD *)(v14 + 64) = *(_OWORD *)(j + 64);
*(_OWORD *)(v14 + 80) = *(_OWORD *)(j + 80);
*(_OWORD *)(v14 + 96) = *(_OWORD *)(j + 96);
MiInsertClone(a2, (_QWORD *)v14, 0);
v14 = v57;
}
v58 = *(_QWORD ***)(j + 8);
v59 = j;
if( v58 )
{
v60 = *v58;
for( j = *(_QWORD *)(j + 8); v60; v60 = (_QWORD *)*v60 )
j = (unsigned __int64)v60;
}
else
{
while( 1 )
{
j = *(_QWORD *)(j + 16) & 0xFFFFFFFFFFFFFFFCui64;
if( !j || *(_QWORD *)j == v59 )
break;
v59 = j;
}
}
}
while( j );
v75 = v56;
CurrentProcess = v82;
v69 = v55;
v10 = v74;
}
v22 = 0;
}
else
{
MiFreeForkMaps((INT64)result);
v22 = -1073741670;
}
MiUnlockWorkingSetExclusive((INT64)(CurrentProcess + 208), WsIrql);
MiLockAweVadsExclusive(a1a);
v61 = MiGetSharedVm((INT64)(CurrentProcess + 208));
ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)v61);
*((_DWORD *)v61 + 1) = 0;
CurrentProcess[156] = 0i64;
MiUnlockWorkingSetExclusive((INT64)(CurrentProcess + 208), WsIrql);
MiUnlockAweVadsExclusive(a1a);
if( v14 )
{
v62 = v69;
do
{
v62 += *(_QWORD *)(v14 + 64);
v63 = *(_QWORD *)v14;
ExFreePoolWithTag((PVOID)v14, 0);
v14 = v63;
}
while( v63 );
v69 = v62;
v10 = v74;
}
if( v69 > v75 )
PsReturnProcessNonPagedPoolQuota(a2, v69 - v75);
if( (_QWORD)v85 )
MiReturnFullProcessCommitment(a2, v85);
if( *((_QWORD *)&v85 + 1) )
MiReturnFullProcessCharges(a2, *((ULONG_PTR *)&v85 + 1));
if( !v8 || v22 < 0 )
MiFreeCloneDescriptor((INT64)CurrentProcess, (INT64)v10);
if( v67 == 1 )
*v83 = 1;
return(unsigned int)v22;
}
MiUnlockWorkingSetExclusive((INT64)(CurrentProcess + 208), v17);
MiUnlockAweVadsExclusive(a1a);
MiFreeCloneDescriptor((INT64)CurrentProcess, (INT64)v10);
PsReturnProcessNonPagedPoolQuota(a2, v11);
ExFreePoolWithTag((PVOID)v14, 0);
}
}Referenced by:
MiCloneProcessAddressSpace