MiActOnLargeKernelHalPages
__int64 __fastcall MiActOnLargeKernelHalPages(
unsigned __int64 a1,
__int64 (__fastcall *a2)(unsigned __int64, unsigned __int64)){
__int64 v4;
__int64 *v5;
int v6;
__int64 v7;
unsigned __int64 v8;
int v9;
unsigned int v10;
unsigned __int64 v11;
unsigned int v12;
unsigned __int64 v13;
__int64 result;
__int64 v15;
int v16;
int v17;
int v18;
__int128 v19;
int v20;
LODWORD(v4) = RtlImageNtHeader(a1);
v15 = 0i64;
v5 = &v15;
v17 = 0;
v6 = 0x40000000;
v20 = 0x40000000;
v7 = v4;
v8 = a1;
v9 = *(unsigned __int16 *)(v4 + 6) + 1;
v16 = *(_DWORD *)(v4 + 84);
v19 = 0i64;
v18 = v16;
do
{
v10 = *((_DWORD *)v5 + 4);
v11 = a1 + *((unsigned int *)v5 + 3);
if( v10 < *((_DWORD *)v5 + 2) )
v10 = *((_DWORD *)v5 + 2);
v12 = *((_DWORD *)v5 + 9) & 0xE0000000;
v13 = ((v10 + 4095i64) & 0xFFFFFFFFFFFFF000ui64) + 0x1FFFFF;
if( v12 != v6 )
{
if( v8 < v11 )
{
result = a2(v8, a1 + *((unsigned int *)v5 + 3));
if( (int)result < 0 )
return result;
}
v6 = v12;
v8 = v11;
}
if( v5 == &v15 )
v5 = (__int64 *)(*(unsigned __int16 *)(v7 + 20) + v7 + 24);
else
v5 += 5;
--v9;
}
while( v9 );
return a2(v8, (v13 + v11) & 0xFFFFFFFFFFE00000ui64);
}Referenced by:
MiCreateSlabAllocationsFromKernelHal
MiInitializeBootLoadedDriverPfns
MiProtectSystemImage