MiSessionInsertImage

__int64 __fastcall MiSessionInsertImage(unsigned __int64 a1, __int64 a2){
  unsigned int v3; 
  _MI_PARTITION *v4; 
  INT64 v5; 
  INT64 v6; 
  UINT64 v7; 
  __int64 v8; 
  int v9; 
  int v10; 
  INT64 *SharedVm; 
  __int64 v12; 
  bool v13; 
  __int64 v15; 
  NTSTATUS active; 
  __int64 SessionVm; 
  __int64 v18; 
  __int64 v19; 
  INT64 result[25]; 
  UINT8 OldIrql; 
  UINT8 v23; 
  v3 = 0;
  OldIrql = 0;
  memset((INT64)result, 0i64);
  v19 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1368i64);
  v4 = *(_MI_PARTITION **)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(v19 + 430));
  SessionVm = MiGetSessionVm();
  LODWORD(v5) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
  v6 = v5;
  if( !v5 )
    return 3221225495i64;
  v7 = *(unsigned int *)(*(_QWORD *)a2 + 8i64);
  if( *(_DWORD *)(*(_QWORD *)a2 + 8i64) && !(unsigned int)MiChargeCommit(v4, (unsigned int)v7, 0i64) )
  {
    active = -1073741670;
LABEL_25:
    ExFreePoolWithTag((PVOID)v6, 0);
    return(unsigned int)active;
  }
  LOBYTE(v8) = MiBytesToMapSystemImage((_FAST_MUTEX *)(v7 << 12));
  v18 = v8;
  v9 = MiControlAreaRequiresCharge(a2);
  v10 = v9;
  if( !v9 )
  {
    MiReturnCommit(v4, v7);
    active = -1073740277;
    goto LABEL_25;
  }
  if( v9 == 2 )
  {
    active = MiReferenceActiveSubsection(a2 + 128, 264, 0x11u);
    if( active < 0 )
    {
      MiReturnCommit(v4, v7);
      goto LABEL_25;
    }
  }
  SharedVm = MiGetSharedVm(SessionVm);
  v23 = ExAcquireSpinLockExclusive((PEX_SPIN_LOCK)SharedVm);
  *((_DWORD *)SharedVm + 1) = 0;
  MmLockLoadedModuleListExclusive(&OldIrql);
  v12 = *(_QWORD *)(v19 + 88);
  v13 = 0;
  if( !v12 )
  {
LABEL_7:
    memset(v6, 0i64);
    *(_QWORD *)(v6 + 40) = a1 | 3;
    *(_QWORD *)(v6 + 72) = v7;
    *(_QWORD *)(v6 + 48) = a1 + v18 - 1;
    *(_DWORD *)(v6 + 60) = 1;
    *(_DWORD *)(v6 + 56) = *(_DWORD *)(v19 + 8);
    *(_QWORD *)(v6 + 80) = a2;
    *(_QWORD *)(v6 + 88) = -2i64;
    if( v10 == 2 )
      *(_BYTE *)(v6 + 65) = 1;
    RtlAvlInsertNodeEx((unsigned __int64 *)(v19 + 88), v12, v13, (_QWORD *)v6);
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)PsLoadedModuleSpinLock);
    __writecr8(OldIrql);
    MiUnlockWorkingSetExclusive(SessionVm, v23);
    _InterlockedExchangeAdd64((volatile signed __int64 *)(v19 + 48), v7);
    result[0] = a2;
    MiManageSubsectionView(result, v6 + 24, 3i64);
    return v3;
  }
  while( a1 > *(_QWORD *)(v12 + 48) )
  {
    v15 = *(_QWORD *)(v12 + 8);
    if( !v15 )
    {
      v13 = 1;
      goto LABEL_7;
    }
LABEL_15:
    v12 = v15;
  }
  if( a1 < (*(_QWORD *)(v12 + 40) & 0xFFFFFFFFFFFFFFFCui64) )
  {
    v15 = *(_QWORD *)v12;
    if( !*(_QWORD *)v12 )
      goto LABEL_7;
    goto LABEL_15;
  }
  ++*(_DWORD *)(v12 + 60);
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)PsLoadedModuleSpinLock);
  __writecr8(OldIrql);
  MiUnlockWorkingSetExclusive(SessionVm, v23);
  v3 = 272;
  ExFreePoolWithTag((PVOID)v6, 0);
  MiReturnCommit(v4, v7);
  if( v10 == 2 )
    MiReturnCrossPartitionControlAreaCharges(a2);
  return v3;
}

Referenced by: