MiReserveDriverPtes

_MMPTE *__stdcall MiReserveDriverPtes(UINT64 SessionImage, UINT64 ExactPtes){
  unsigned int v2; 
  _ETHREAD *CurrentThread; 
  __int64 v4; 
  unsigned int v6; 
  UINT8 *v7; 
  _MMPTE *v8; 
  __int64 i; 
  unsigned int ClearBitsAndSet; 
  unsigned int v12; 
  _RTL_BITMAP *Pool; 
  int v14; 
  VOID *v15; 
  _MMPTE *PteAddress; 
  _MI_TB_FLUSH_LIST *v17; 
  _RTL_BITMAP *v18; 
  VOID *BaseVa; 
  VOID *BaseVaa; 
  _TABLE_SEARCH_RESULT v21; 
  UINT64 v22; 
  unsigned __int64 v24; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = v2;
  v6 = (unsigned int)(SessionImage + 15) >> 4;
  MiLockDriverMappings(CurrentThread);
  v8 = 0i64;
  if( !ExactPtes )
  {
    for( i = MiState[v4 + 142]; i; i = *(_QWORD *)i )
    {
      if( (*(_DWORD *)(i + 36) & 1) == 0 && *(_DWORD *)(i + 16) >= v6 )
      {
        ClearBitsAndSet = (unsigned int)RtlFindClearBitsAndSet(
                                          (_RTL_AVL_TABLE *)(i + 16),
                                          (VOID *)v6,
                                          *(unsigned int *)(i + 32),
                                          v7,
                                          BaseVa,
                                          v21);
        if( ClearBitsAndSet != -1 )
        {
          v8 = (_MMPTE *)(*(_QWORD *)(i + 8) + ((unsigned __int64)ClearBitsAndSet << 7));
          *(_DWORD *)(i + 32) = v6 + ClearBitsAndSet;
          goto LABEL_8;
        }
      }
    }
  }
  v12 = (unsigned __int8)ExGenRandom(ExGenRandomDomainUserVisible);
  v24 = (16 * (v6 + v12) + 511) & 0xFFFFFE00;
  v22 = (v24 >> 7) + 40;
  Pool = (_RTL_BITMAP *)MiAllocatePool((_DWORD)InitializationPhase != 0 ? 256i64 : 64i64, v22, 0x70446D4Dui64);
  if( !Pool )
  {
LABEL_8:
    MiUnlockDriverMappings(CurrentThread);
    return v8;
  }
  v14 = 12 - ((_DWORD)v4 != 0);
  v15 = MiObtainSystemVa(((16 * (v6 + v12) + 511) & 0xFFFFFE00) >> 9, (_MI_SYSTEM_VA_TYPE)v14);
  BaseVaa = v15;
  if( !v15 )
    goto LABEL_18;
  PteAddress = MiGetPteAddress(v15);
  if( !(_DWORD)v4 && !MiMakeZeroedPageTables(PteAddress, &PteAddress[v24 - 1], 1ui64, (_MI_SYSTEM_VA_TYPE)v14) )
  {
    MiReturnSystemVa(
      BaseVaa,
      (VOID *)((__int64)(((_QWORD)PteAddress << 25) - ((_QWORD)MmGetPteBase() << 25) + (v24 << 28)) >> 16),
      (_MI_SYSTEM_VA_TYPE)v14,
      v17);
LABEL_18:
    MiUnlockDriverMappings(CurrentThread);
    ExFreePoolWithTag(Pool, 0);
    return 0i64;
  }
  memset(&Pool[2].Buffer, 0i64, v22 - 40);
  v18 = Pool + 1;
  Pool[1].SizeOfBitMap = ((16 * (v6 + v12) + 511) & 0xFFFFFE00) >> 4;
  Pool[1].Buffer = (unsigned int *)&Pool[2].Buffer;
  if( ExactPtes )
  {
    v12 = 0;
    RtlSetAllBits(v18);
    LODWORD(v8) = 2;
  }
  else
  {
    RtlSetBits(v18, v12, v6);
  }
  *(&Pool[2].SizeOfBitMap + 1) = (unsigned int)v8;
  Pool->Buffer = (unsigned int *)PteAddress;
  Pool[2].SizeOfBitMap = v6 + v12;
  *(_QWORD *)&Pool->SizeOfBitMap = MiState[v4 + 142];
  MiState[v4 + 142] = (__int64)Pool;
  MiUnlockDriverMappings(CurrentThread);
  return &PteAddress[16 * (unsigned __int64)v12];
}

Referenced by: