MiFillMapFileInfo

INT64 __fastcall MiFillMapFileInfo(INT64 a1, INT64 a2){
  unsigned __int64 *v3; 
  int v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  unsigned __int64 v8; 
  _FILE_OBJECT *v9; 
  unsigned int SessionId; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  unsigned __int64 v15; 
  INT64 result; 
  _SUBSECTION *ContainingSubsection; 
  v3 = (unsigned __int64 *)(a2 + 16);
  ContainingSubsection = 0i64;
  v5 = *(_DWORD *)(a1 + 48);
  v6 = *(_QWORD *)(a1 + 112) & 0xFFFFFFFFFFFFFFFEui64;
  v7 = **(_QWORD **)(a1 + 72);
  v8 = *(unsigned int *)(a1 + 24) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 32) << 32);
  *(_QWORD *)(a2 + 16) = 0i64;
  if( *(_QWORD *)(v7 + 64) )
  {
    v9 = MiReferenceControlAreaFile((_CONTROL_AREA *)v7);
    *(_QWORD *)(a2 + 8) = v9->FsContext;
    MiDereferenceControlAreaFile(v7, (unsigned __int64)v9);
    MiGetProtoPteAddress((_MMVAD *)a1, v8, 0i64, &ContainingSubsection);
    SessionId = MmGetSessionIdEx(v6);
    v11 = *v3 ^ (MiStartingOffset((__int64)ContainingSubsection, *(_QWORD *)(a1 + 80), SessionId) ^ *v3) & 0xFFFFFFFFFFFFi64;
    *v3 = v11;
    if( (v5 & 0x70) == 32 )
    {
      if( (*(_DWORD *)(a1 + 48) & 0xF80) == 896 )
      {
        v12 = v11 & 0xFF7FFFFFFFFFFFFFui64;
        v13 = 0x40000000000000i64;
      }
      else
      {
        v12 = v11 & 0xFFBFFFFFFFFFFFFFui64;
        v13 = 0x80000000000000i64;
      }
      v14 = v13 | v12;
    }
    else
    {
      v14 = v11 & 0xFF3FFFFFFFFFFFFFui64;
    }
  }
  else
  {
    v14 = 0xC0000000000000i64;
    *(_QWORD *)(a2 + 8) = *(_QWORD *)(a1 + 80);
  }
  *v3 = v14;
  v15 = ((unsigned __int64)(*(_DWORD *)(a1 + 64) & 0x1000000) << 29) | *v3 & 0xFFDFFFFFFFFFFFFFui64;
  *v3 = v15;
  *(_DWORD *)(a2 + 40) = *(_DWORD *)(v6 + 1088);
  *(_QWORD *)a2 = v8 << 12;
  *(_QWORD *)(a2 + 24) = ((*(unsigned int *)(a1 + 28) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 33) << 32))
                        - (*(unsigned int *)(a1 + 24) | ((unsigned __int64)*(unsigned __int8 *)(a1 + 32) << 32))
                        + 1) << 12;
  *v3 = v15 ^ (v15 ^ ((unsigned __int64)*(unsigned int *)(a1 + 48) << 41)) & 0x1F000000000000i64;
  result = *(unsigned int *)(a1 + 52);
  LODWORD(result) = result & 0x7FFFFFFF;
  *(_QWORD *)(a2 + 32) = (result | ((unsigned __int64)*(unsigned __int8 *)(a1 + 34) << 31)) << 12;
  return result;
}

Referenced by: