MiCompleteRestrictedImageFault

INT64 __fastcall MiCompleteRestrictedImageFault(INT64 rcx0, INT64 rdx0, INT64 *a3, UINT64 a4){
  unsigned int v4; 
  INT64 *v5; 
  UINT64 v6; 
  _MMPFN *PfnDb; 
  unsigned int v9; 
  INT64 v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  _CONTROL_AREA *v13; 
  _FILE_OBJECT *v14; 
  _FILE_OBJECT *v15; 
  unsigned int v16; 
  INT64 v17; 
  char *v18; 
  unsigned __int64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  UINT64 v22; 
  unsigned int SessionIdForVa; 
  unsigned __int64 v24; 
  _ETHREAD *CurrentThread; 
  UINT64 v26; 
  UINT64 v27; 
  struct _EX_RUNDOWN_REF *v28; 
  struct _EX_RUNDOWN_REF *v29; 
  int v30; 
  int v31; 
  unsigned __int64 v32; 
  UINT64 ValidPte; 
  WCHAR *v34; 
  UNICODE_STRING *v35; 
  __int64 v36; 
  int v37; 
  __int16 v38; 
  int v39; 
  __int16 v40; 
  __int16 v41; 
  UINT8 v42; 
  int v43; 
  char v44; 
  char v45; 
  int Wsle; 
  _MMPFN *v47; 
  UINT64 v48; 
  _MMPFN *UsedPtesHandle; 
  INT64 a5; 
  _FILE_OBJECT *a2; 
  INT64 *v53; 
  INT64 v54; 
  unsigned __int64 v55; 
  __int64 v56; 
  __int64 v57; 
  UINT64 SpinCount; 
  UINT64 a1; 
  INT64 *v60; 
  unsigned int v61; 
  v61 = a4;
  v60 = a3;
  a1 = rdx0;
  v4 = a4;
  v56 = *(_QWORD *)rcx0;
  v5 = a3;
  v6 = rdx0;
  PfnDb = MmGetPfnDb();
  v9 = 1;
  v10 = (INT64)PfnDb + 48 * *a3;
  v11 = *(_QWORD *)(v10 + 8) | 0x8000000000000000ui64;
  v12 = *(_QWORD *)(v10 + 16);
  v55 = v11;
  if( qword_140C4DC80 && (v12 & 0x10) == 0 )
    v12 &= ~qword_140C4DC80;
  v13 = *(_CONTROL_AREA **)(v12 >> 16);
  v57 = (__int64)v13;
  if( PfSnNumActiveTraces )
  {
    v14 = MiReferenceControlAreaFile(v13);
    v11 = v55;
    v15 = v14;
    PfnDb = MmGetPfnDb();
  }
  else
  {
    v15 = 0i64;
  }
  a2 = v15;
  v16 = 0;
  if( v4 )
  {
    v53 = v5;
    while( 1 )
    {
      v17 = *v5;
      v54 = *v5;
      v18 = (char *)PfnDb + 48 * *v5;
      v19 = *((_QWORD *)v18 + 2);
      v20 = v19;
      if( qword_140C4DC80 && (v19 & 0x10) == 0 )
        v20 = v19 & ~qword_140C4DC80;
      v21 = *((_QWORD *)v18 + 1) | 0x8000000000000000ui64;
      v22 = v6 + 8 * ((__int64)(v21 - v11) >> 3);
      if( !v15 )
        goto LABEL_19;
      SessionIdForVa = MiGetSessionIdForVa((PVOID)((__int64)((v22 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16));
      v24 = MiStartingOffset(v20 >> 16, v21, SessionIdForVa);
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      v26 = v24;
      v28 = PfSnReferenceProcessTrace(*((_QWORD *)CurrentThread + 23), v27);
      v29 = v28;
      if( !v28 )
        break;
      v30 = PfSnCheckLoggingForThread((INT64)CurrentThread, (INT64)v28, 1);
      v32 = (unsigned __int64)a2;
      if( v30 )
      {
        LODWORD(a5) = v31;
        PfSnLogPageFaultCommon((INT64)v29, a2, (UINT64)a2->FsContext, v26, a5);
      }
      ExReleaseRundownProtection(v29 + 45);
      v17 = v54;
      v5 = v53;
LABEL_20:
      ValidPte = MiMakeValidPte(v22, v17, (v19 >> 5) & 0x1F);
      v35 = (UNICODE_STRING *)*(unsigned __int8 *)(rcx0 + 13);
      v36 = ValidPte & 0xFFFFFFFFFFFFFFDFui64;
      if( ((unsigned __int8)v35 & 5) != 4 || ((unsigned __int8)v35 & 2) != 0 )
      {
        v9 = 1;
        goto LABEL_35;
      }
      v37 = *(unsigned __int16 *)(rcx0 + 10);
      v38 = 511;
      if( (_WORD)v37 )
      {
        if( v37 + *(unsigned __int16 *)(rcx0 + 8) == (((unsigned int)v22 >> 3) & 0x1FF) )
        {
          LOBYTE(v35) = (unsigned __int8)v35 & 0x10;
          LOBYTE(v39) = MI_PFN_IS_PROTO((UNICODE_STRING *)v18, v35, 0xFFu, v34);
          if( v39 )
          {
            if( !(_BYTE)v35 )
              goto LABEL_29;
          }
          else if( (_BYTE)v35 )
          {
            goto LABEL_29;
          }
        }
        MiEmptyDeferredWorkingSetEntries(rcx0);
        v38 = 511;
      }
LABEL_29:
      v40 = *(_WORD *)(rcx0 + 10);
      v9 = 1;
      if( v40 )
      {
        *(_WORD *)(rcx0 + 10) = v40 + 1;
      }
      else
      {
        *(_WORD *)(rcx0 + 10) = 1;
        v41 = v38 & ((unsigned int)v22 >> 3);
        v42 = *(_BYTE *)(rcx0 + 13);
        *(_WORD *)(rcx0 + 8) = v41;
        LOBYTE(v43) = MI_PFN_IS_PROTO((UNICODE_STRING *)v18, v35, v42, v34);
        v45 = v44 & 0xEF;
        if( !v43 )
          v45 = v44 | 0x10;
        *(_BYTE *)(rcx0 + 13) = v45;
      }
LABEL_35:
      Wsle = MiAllocateWsle(v56, v22, v18, 0, v36, 12, 0i64);
      v4 = v61;
      v6 = a1;
      if( !Wsle )
      {
        v5 = v60;
        v9 = 0;
        goto LABEL_40;
      }
      v11 = v55;
      ++v5;
      ++v16;
      v53 = v5;
      PfnDb = MmGetPfnDb();
      if( v16 >= v61 )
      {
        v5 = v60;
        goto LABEL_40;
      }
      v15 = a2;
    }
    v17 = v54;
    v5 = v53;
LABEL_19:
    v32 = (unsigned __int64)a2;
    goto LABEL_20;
  }
  v32 = (unsigned __int64)v15;
LABEL_40:
  if( v16 )
  {
    if( *(_WORD *)(rcx0 + 10) )
      MiEmptyDeferredWorkingSetEntries(rcx0);
    v47 = MmGetPfnDb();
    v48 = (UINT64)v47 + 48 * MiGetContainingPageTable(v6);
    LODWORD(SpinCount) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)(v48 + 24), 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *(__int64 *)(v48 + 24) < 0 );
    }
    *(_QWORD *)(v48 + 24) ^= (*(_QWORD *)(v48 + 24) ^ (*(_QWORD *)(v48 + 24) + v16)) & 0x3FFFFFFFFFFFFFFFi64;
    _InterlockedAnd64((volatile signed __int64 *)(v48 + 24), 0x7FFFFFFFFFFFFFFFui64);
    UsedPtesHandle = MiGetUsedPtesHandle((__int64)((v6 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16);
    MiIncreaseUsedPtesCount(UsedPtesHandle, v16);
  }
  else
  {
    *(_WORD *)(rcx0 + 10) = 0;
    v47 = MmGetPfnDb();
  }
  for( ; v16 != v4; ++v16 )
    MiLockAndDecrementShareCount((UINT64)v47 + 48 * v5[v16], 0);
  if( v32 )
    MiDereferenceControlAreaFile(v57, v32);
  return v9;
}

Referenced by: