MiInitializeWalkBounds
INT64 __fastcall MiInitializeWalkBounds(INT64 a1, _QWORD *a2){
__int64 v2;
unsigned int v3;
__int64 v4;
INT64 result;
if( (*(_WORD *)a1 & 0x800) != 0 )
{
*a2 = 0i64;
a2[1] = (char *)MmGetPteBase() - 1;
a2[2] = 0xFFFFF70000000000ui64;
result = 2i64;
a2[3] = -1i64;
}
else
{
v2 = *(_QWORD *)(a1 + 24);
v3 = 1;
switch( *(_BYTE *)(v2 + 184) & 7 )
{
case 0:
*a2 = 0i64;
a2[1] = 0x7FFFFFFFFFFFi64;
a2[2] = qword_140C4E0A0;
v4 = qword_140C4E0B0;
if( !qword_140C4E0B0 )
{
v4 = 276840448i64;
qword_140C4E0C0 = 0x10000000i64;
qword_140C4E0B0 = 276840448i64;
qword_140C4E0B8[0] = 276824064i64;
}
v3 = 2;
a2[3] = qword_140C4E0A0 - 1 + v4;
return v3;
case 1:
*a2 = qword_140C4DB18;
a2[1] = qword_140C4DB18 + 0x7FFFFFFFFFi64;
return 1i64;
case 2:
*a2 = qword_140C4DF18;
result = 1i64;
a2[1] = qword_140C4DF18 - 1 + (qword_140C4DEF8 << 21);
break;
case 3:
*a2 = qword_140C4DED0;
result = 1i64;
a2[1] = qword_140C4DED0 - 1 + (qword_140C4DEB0 << 21);
break;
case 4:
*a2 = qword_140C4DE40;
result = 1i64;
a2[1] = qword_140C4DE40 - 1 + (qword_140C4DE20 << 21);
break;
case 6:
*a2 = qword_140C4DDB0;
result = 1i64;
a2[1] = qword_140C4DDB0 - 1 + (qword_140C4DD90 << 21);
break;
default:
return v3;
}
}
return result;
}Referenced by:
MiGenerateRandomPte
MiWalkPageTables