MiMemoryLicense
VOID __fastcall MiMemoryLicense(_LOADER_PARAMETER_BLOCK *LoaderBlock){
UINT64 v2;
UINT64 v3;
_UNICODE_STRING ValueName;
unsigned int Data;
UINT64 ResultDataSize;
UINT64 Type;
LODWORD(Type) = 0;
Data = 0;
ValueName.Buffer = L"Kernel-WindowsMaxMemAllowedx64";
*(_QWORD *)&ValueName.Length = 4063292i64;
LODWORD(ResultDataSize) = 4;
if( (int)NtQueryLicenseValue(&ValueName, &Type, &Data, 4ui64, &ResultDataSize) >= 0 && Data )
v2 = (unsigned __int64)Data << 8;
else
v2 = 0x80000i64;
v3 = ((unsigned __int64)qword_140C4DC80 >> 12) - 1;
qword_140C4DC30 = v2;
if( v3 >= 0xFFFFFFFFAi64 )
v3 = 0xFFFFFFFFAi64;
MiLimitLoaderBlockHighMemory(LoaderBlock, v3);
MiLimitLoaderBlockTotalMemory(LoaderBlock, v2);
BasePage = -1i64;
LOBYTE(Mm64BitPhysicalAddress) = 1;
if( v3 > 0xFFFFFF7FAi64 )
MiLimitLoaderBlockHighMemory(LoaderBlock, 0xFFFFFF7FAui64);
BasePage = 0xFFFFFF7FAi64;
}Referenced by:
MiInitNucleus