MiLockAddressSpaceToo

char __fastcall MiLockAddressSpaceToo(__int64 a1, __int64 a2){
  _ETHREAD *CurrentThread; 
  unsigned __int64 v4; 
  _ETHREAD *v5; 
  unsigned __int8 v6; 
  __int64 v7; 
  __int64 v8; 
  int SessionId; 
  _QWORD *v10; 
  char v12; 
  unsigned int v14; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 243);
  v14 = 0;
  v4 = a1 + 1224;
  v5 = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)v5 + 243);
  if( ++*((_BYTE *)v5 + 794) != 1 )
  {
    v8 = 0i64;
    goto LABEL_9;
  }
  v6 = *((_BYTE *)v5 + 792);
  if( !v6 )
  {
    if( !*((_BYTE *)v5 + 870) )
    {
      v8 = 0i64;
      goto LABEL_9;
    }
    v12 = *((_BYTE *)v5 + 870);
    *((_BYTE *)v5 + 870) = 0;
    v6 = v12 | *((_BYTE *)v5 + 792);
  }
  _BitScanForward((unsigned int *)&v7, v6);
  *((_BYTE *)v5 + 792) = v6 & ~(1 << v7);
  v8 = *((_QWORD *)v5 + 100) + 96 * v7;
  if( !v8 )
  {
LABEL_9:
    _interlockedbittestandset((volatile signed __int32 *)v5 + 30, 0x10u);
    goto LABEL_10;
  }
  if( v4 >= 0xFFFF800000000000ui64 && *((_BYTE *)&antNameB + ((v4 >> 39) & 0x1FF) - 256) == 1 )
    SessionId = MmGetSessionIdEx(*((_QWORD *)v5 + 23));
  else
    SessionId = -1;
  *(_DWORD *)(v8 + 40) = SessionId;
  *(_QWORD *)(v8 + 32) = v4 & 0x7FFFFFFFFFFFFFFCi64;
LABEL_10:
  --*((_BYTE *)v5 + 794);
  LOBYTE(v10) = KiAbThreadRemoveBoosts((ULONG_PTR)v5, v4, &v14);
  if( (*((_WORD *)v5 + 243))++ == 0xFFFF )
  {
    v10 = (_QWORD *)((char *)v5 + 152);
    if( (_QWORD *)*v10 != v10 )
      LOBYTE(v10) = KiCheckForKernelApcDelivery();
  }
  if( _interlockedbittestandset64((volatile signed __int32 *)v4, 0i64) )
  {
    if( v8 )
      KeAbPostReleaseEx((PVOID)v4, (PVOID)v8);
    MiUnlockVad((__int64)CurrentThread, a2);
    --*((_WORD *)CurrentThread + 243);
    ExAcquirePushLockExclusiveEx(v4, 0i64);
    *((_BYTE *)CurrentThread + 1304) |= 1u;
    --*((_WORD *)CurrentThread + 243);
    ExAcquirePushLockExclusiveEx(a2 + 40, 0i64);
    *((_BYTE *)CurrentThread + 1304) |= 0x80u;
    LOBYTE(v10) = KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  else
  {
    if( v8 )
      *(_BYTE *)(v8 + 26) |= 1u;
    *((_BYTE *)CurrentThread + 1304) |= 1u;
  }
  return(char)v10;
}

Referenced by: