MiSessionCreate

NTSTATUS __stdcall MiSessionCreate(UINT64 *SessionId){
  NTSTATUS result; 
  _EPROCESS *v2; 
  _EPROCESS *Process; 
  _MI_PARTITION *ProcessPartition; 
  _MM_SESSION_SPACE *Session; 
  _MMSUPPORT_INSTANCE *v6; 
  __int64 v7; 
  _MMPTE *PteAddress; 
  _MMPTE *v9; 
  UINT64 v10; 
  _MMPTE *v11; 
  UINT64 v12; 
  int v13; 
  __int64 DemandZeroPte; 
  unsigned __int64 v15; 
  int v16; 
  INT64 v17; 
  INT64 v18; 
  _MM_SESSION_SPACE *v19; 
  void *Pool; 
  int v21; 
  int v22; 

  result = MiInitializeSessionGlobals();
  if( result < 0 )
    return result;
  Process = KeGetCurrentThread()->ApcState.Process;
  ProcessPartition = MiGetProcessPartition(Process, v2);
  result = MiSessionCreateInternal((UINT64 *)&ProcessPartition->Core.PartitionId);
  if( result < 0 )
    return result;
  Session = Process->Session;
  v6 = (_MMSUPPORT_INSTANCE *)((char *)Session + 256);
  if( !MiCreateSystemWsles()
    || !MiInitializeDynamicBitmap((_RTL_BITMAP_EX *)Session + 55, BitmapStart, 0x200000ui64, 0i64) )
  {
    goto LABEL_22;
  }
  *((_QWORD *)Session + 105) = qword_140C4CAD0;
  *((_QWORD *)Session + 104) = 0x10000i64;
  PteAddress = MiGetPteAddress(qword_140C4CAD0);
  v9 = MiGetPteAddress((VOID *)(v7 + 0x1FFF));
  v10 = QuotaCharge;
  v11 = v9;
  if( !QuotaCharge )
  {
    v10 = v9 - PteAddress + 1;
    QuotaCharge = v10;
  }
  if( !MiChargeCommit(ProcessPartition, v10, 0i64) )
    goto LABEL_22;
  if( !MiMakeZeroedPageTables(PteAddress, v11, 1ui64, MiVaSessionGlobalSpace) )
  {
    MiReturnCommit(ProcessPartition, QuotaCharge);
    goto LABEL_22;
  }
  v12 = QuotaCharge + *((_QWORD *)Session + 6);
  *((_DWORD *)Session + 1) |= 8u;
  *((_QWORD *)Session + 6) = v12;
  DemandZeroPte = MiMakeDemandZeroPte(4);
  if( PteAddress <= v11 )
  {
    do
    {
      v15 = DemandZeroPte;
      LOBYTE(v16) = MiPteInShadowRange((UINT64)PteAddress);
      if( v16 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (DemandZeroPte & 1) != 0 )
        v15 = DemandZeroPte | 0x8000000000000000ui64;
      PteAddress->u.Long = v15;
      ++PteAddress;
    }
    while( PteAddress <= v11 );
    v13 = *((_DWORD *)Session + 1);
    v6 = (_MMSUPPORT_INSTANCE *)((char *)Session + 256);
  }
  *((_DWORD *)Session + 1) = v13 | 0x10;
  MiInitializeSystemWorkingSetList((ULONG_PTR *)&ProcessPartition->Core.PartitionId, v6, WorkingSetTypeSession, 0i64);
  v17 = qword_140C4CAE0;
  *((_QWORD *)Session + 7) = qword_140C4CAE0;
  v18 = qword_140C4CAE0 + 0x1FFFFFFFFFi64;
  *((_QWORD *)Session + 8) = qword_140C4CAE0 + 0x1FFFFFFFFFi64;
  result = ExInitializeSessionHeapManager(v17, v18);
  if( result >= 0 )
  {
    *((_DWORD *)Session + 1) |= 0x80u;
    v19 = KeGetCurrentThread()->ApcState.Process->Session;
    *((_QWORD *)v19 + 21) = 0i64;
    *((_QWORD *)v19 + 22) = 0x2000000i64;
    *((_DWORD *)v19 + 1) |= 4u;
    Pool = MiAllocatePool(260i64, 1ui64, 0x6C6F6F50ui64);
    if( Pool )
      ExFreePoolWithTag(Pool, 0);
    *((_DWORD *)Session + 1) |= 1u;
    MiInitializeSystemSpaceMap((_MMSESSION *)Session + 6);
    if( v21 )
    {
      v22 = MiSessionObjectCreate();
      if( v22 < 0 )
        MiDereferenceSession();
      return v22;
    }
LABEL_22:
    MiDereferenceSession();
    return -1073741670;
  }
  return result;
}

Referenced by: