MiCopyHeaderIfResident

UINT64 __stdcall MiCopyHeaderIfResident(FILE_OBJECT *File, UINT64 ImagePageFrameNumber){
  unsigned __int64 v4; 
  _SECTION_OBJECT_POINTERS *SectionObjectPointer; 
  INT64 *DataSectionObject; 
  INT64 v8; 
  INT64 v9; 
  _MMPFN *v10; 
  char v11; 
  UINT64 v12; 
  int v13; 
  __int64 v14; 
  volatile signed __int32 *v15; 
  UINT64 v16; 
  UINT64 v17; 
  _MMPFN *a4; 
  UINT64 v19; 
  _MMPFN *a3; 
  a4 = 0i64;
  a3 = 0i64;
  v19 = 0i64;
  while( 1 )
  {
    v4 = ExAcquireSpinLockExclusive(&dword_140C4C6C0);
    SectionObjectPointer = File->SectionObjectPointer;
    if( !SectionObjectPointer || (DataSectionObject = (INT64 *)SectionObjectPointer->DataSectionObject) == 0i64 )
    {
      ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
LABEL_5:
      __writecr8(v4);
      return 0i64;
    }
    if( (unsigned int)ExTryAcquireSpinLockExclusiveAtDpcLevel(DataSectionObject + 9) )
      break;
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
    __writecr8(v4);
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4C6C0);
  if( (DataSectionObject[7] & 3) != 0
    || (v9 = DataSectionObject[17]) == 0
    || (int)MiTryLockProtoPoolPageAtDpc((INT64 *)DataSectionObject[17], v8, &a3, &a4) < 0 )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
    goto LABEL_5;
  }
  v10 = a4;
  v11 = *((_BYTE *)a4 + 34);
  if( (v11 & 0x20) != 0 || (v11 & 0xC0) != 64 || (*((_BYTE *)a4 + 35) & 0x40) != 0 || MiIsPageOnBadList((INT64)a4) )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
    __writecr8(2ui64);
    v17 = 0x7FFFFFFFFFFFFFFFi64;
    _InterlockedAnd64((volatile signed __int64 *)v10 + 3, 0x7FFFFFFFFFFFFFFFui64);
    goto LABEL_30;
  }
  v19 = MI_READ_PTE_LOCK_FREE(v9);
  v12 = v19;
  if( (v19 & 1) != 0 )
  {
    MiPteInShadowRange((UINT64)&v19);
    v13 = 0;
  }
  else
  {
    if( qword_140C4DC80 )
    {
      if( (v19 & 0x10) != 0 )
        v12 = v19 & 0xFFFFFFFFFFFFFFEFui64;
      else
        v12 = ~qword_140C4DC80 & v19;
    }
    v13 = 1;
  }
  v14 = (v12 >> 12) & 0xFFFFFFFFFi64;
  v15 = (volatile signed __int32 *)((char *)MmGetPfnDb() + 48 * ImagePageFrameNumber);
  if( _interlockedbittestandset64(v15 + 6, 0x3Fui64) )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
    __writecr8(2ui64);
    v17 = 0x7FFFFFFFFFFFFFFFi64;
    _InterlockedAnd64((volatile signed __int64 *)a4 + 3, 0x7FFFFFFFFFFFFFFFui64);
LABEL_30:
    LOBYTE(v17) = v4;
    MiUnlockProtoPoolPage(a3, v17);
    return 0i64;
  }
  MiCopyPage(ImagePageFrameNumber, v14, 0i64, 4);
  ExReleaseSpinLockExclusiveFromDpcLevel(DataSectionObject + 9);
  __writecr8(2ui64);
  if( v13 == 1 )
    MiUpdatePageAttributeStamp(a4);
  v16 = 0x7FFFFFFFFFFFFFFFi64;
  _InterlockedAnd64((volatile signed __int64 *)v15 + 3, 0x7FFFFFFFFFFFFFFFui64);
  _InterlockedAnd64((volatile signed __int64 *)a4 + 3, 0x7FFFFFFFFFFFFFFFui64);
  LOBYTE(v16) = v4;
  MiUnlockProtoPoolPage(a3, v16);
  return 1i64;
}

Referenced by: