MiAllocateKernelStackPages

UINT64 __stdcall MiAllocateKernelStackPages(
        _MMPTE *PointerPte,
        UINT64 NumberOfPages,
        _ETHREAD *StackOwner,
        UINT16 PreferredNode,
        UINT64 StackFlags){
  _ETHREAD *v5; 
  unsigned __int64 v6; 
  _MMPFN *v9; 
  signed __int32 v10; 
  unsigned int v11; 
  UINT64 Page; 
  UINT64 v13; 
  char *v14; 
  UINT64 ValidPte; 
  UINT64 v16; 
  _MMPTE *PteBase; 
  unsigned __int64 v18; 
  UINT64 v19; 
  _MMPFN *v20; 
  UINT64 v21; 
  UINT64 v22; 
  _ETHREAD *CurrentThread; 
  char *v24; 
  unsigned int v25; 
  unsigned int v26; 
  __int64 v27; 
  unsigned __int64 v28; 
  UINT64 SpinCount; 
  BOOL v30; 
  BOOL v31; 
  UINT64 v32; 
  UINT64 v33; 
  INT64 v34[2]; 
  char *v35; 
  UINT64 v36; 
  UINT8 v37; 
  unsigned __int64 v38; 
  char v39; 
  v38 = PreferredNode;
  v5 = StackOwner;
  v6 = NumberOfPages;
  *(_OWORD *)v34 = 0i64;
  if( !StackOwner )
    return 1i64;
  v9 = 0i64;
  v36 = NumberOfPages + 8i64 * (_QWORD)StackOwner;
  MiInitializePageColorBase(0i64, (unsigned int)(StackFlags + 1), (INT64)v34);
  while( 1 )
  {
    v10 = _InterlockedExchangeAdd((volatile signed __int32 *)v34[0], 1u);
    v11 = v34[1] & v10 | HIDWORD(v34[1]);
    Page = MiGetPage((_MI_PARTITION *)PointerPte, v11, 0i64);
    if( Page == -1i64 )
      break;
LABEL_7:
    v14 = (char *)MmGetPfnDb() + 48 * Page;
    *(_QWORD *)v14 = v9;
    v9 = (_MMPFN *)v14;
    v5 = (_ETHREAD *)((char *)v5 - 1);
    if( !v5 )
    {
      ValidPte = MiMakeValidPte(v6, 0i64, 2684354564i64);
      v16 = 0i64;
      v37 = MiLockWorkingSetShared((INT64)&qword_140C4F240);
      HIDWORD(SpinCount) = MiProtectionToCacheAttribute(4ui64);
      v31 = MiPteInShadowRange((UINT64)&v33);
      PteBase = MmGetPteBase();
      while( 1 )
      {
        v35 = *(char **)v14;
        ValidPte ^= (ValidPte ^ (((v14 - (char *)MmGetPfnDb()) / 48) << 12)) & 0xFFFFFFFFF000i64;
        if( !v16 )
          goto LABEL_12;
        if( (v6 & 0xFFF) == 0 )
          break;
LABEL_13:
        v18 = *(_QWORD *)v6;
        v30 = MiPteInShadowRange(v6);
        if( v18 )
          v19 = v18 & 0xFFFFFFFFFFFFFC1Fui64 | 0x80;
        else
          v19 = MiSwizzleInvalidPte(128i64);
        v32 = v19;
        MiSetNonResidentPteHeat(&v32, 0i64);
        v21 = v32;
        *(_QWORD *)v14 &= 0xFFFFFFFFFFFFC00Fui64;
        *((_QWORD *)v14 + 2) = v21 & 0xFFFFFFFFFC00FFFFui64;
        *((_WORD *)v14 + 16) = 1;
        v33 = *(_QWORD *)((char *)PteBase + ((v6 >> 9) & 0x7FFFFFFFF8i64));
        v22 = (v33 >> 12) & 0xFFFFFFFFFi64;
        *((_QWORD *)v14 + 5) = v22 | *((_QWORD *)v14 + 5) & 0xFFFFFFF000000000ui64;
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        v24 = (char *)MmGetPfnDb() + 48 * v22;
        v25 = *((_DWORD *)CurrentThread + 326);
        if( (v25 & 0x100) != 0 )
          v26 = v25 >> 9;
        else
          LOBYTE(v26) = PsGetPagePriorityThread((__int64)CurrentThread);
        LODWORD(SpinCount) = 0;
        while( _interlockedbittestandset64((volatile signed __int32 *)v14 + 6, 0x3Fui64) )
        {
          do
            KeYieldProcessorEx(&SpinCount);
          while( *((__int64 *)v14 + 3) < 0 );
        }
        MiLockNestedPageAtDpcInline((INT64)v24);
        *((_QWORD *)v24 + 3) ^= (*((_QWORD *)v24 + 3) ^ (*((_QWORD *)v24 + 3) + 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
        _InterlockedAnd64((volatile signed __int64 *)v24 + 3, 0x7FFFFFFFFFFFFFFFui64);
        if( (unsigned __int8)v14[34] >> 6 != HIDWORD(SpinCount) )
          MiChangePageAttribute((INT64)v14, HIDWORD(SpinCount), 1);
        MiSetPfnTbFlushStamp((_MMPFN *)v14, 0i64, 1ui64);
        v27 = *((_QWORD *)v14 + 3);
        v14[35] ^= (v14[35] ^ v26) & 7;
        *((_QWORD *)v14 + 1) = v6;
        *((_QWORD *)v14 + 3) = v27 & 0xC000000000000000ui64 | 1;
        v14[34] = v14[34] & 0xF8 | 6;
        v14[34] |= 0x10u;
        _InterlockedAnd64((volatile signed __int64 *)v14 + 3, 0x7FFFFFFFFFFFFFFFui64);
        v28 = ValidPte;
        if( v30 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (ValidPte & 1) != 0 )
          v28 = ValidPte | 0x8000000000000000ui64;
        *(_QWORD *)v6 = v28;
        MiMarkKernelStack((unsigned __int64 *)v6, v38);
        v14 = v35;
        v6 += 8i64;
        PteBase = MmGetPteBase();
        if( v6 >= v36 )
        {
          if( v16 )
            MiUnlockPageTableInternal((INT64)&qword_140C4F240, v16);
          MiUnlockWorkingSetShared((INT64)&qword_140C4F240, v37);
          return 1i64;
        }
      }
      MiUnlockPageTableInternal((INT64)&qword_140C4F240, v16);
LABEL_12:
      v16 = (UINT64)PteBase + ((v6 >> 9) & 0x7FFFFFFFF8i64);
      MiLockPageTableInternal((INT64)&qword_140C4F240, v16, 0i64);
      goto LABEL_13;
    }
  }
  while( (v39 & 2) == 0 )
  {
    MiWaitForFreePage((_MI_PARTITION *)PointerPte, v13);
    Page = MiGetPage((_MI_PARTITION *)PointerPte, v11, 0i64);
    if( Page != -1i64 )
      goto LABEL_7;
  }
  if( v9 )
  {
    do
    {
      v20 = *(_MMPFN **)v9;
      MiReleaseFreshPage(v9);
      v9 = v20;
    }
    while( v20 );
  }
  return 0i64;
}

Referenced by: