MiValidateImagePfn

NTSTATUS __stdcall MiValidateImagePfn(
        _CONTROL_AREA *ControlArea,
        UINT64 FileOffset,
        _EPROCESS *CallingProcess,
        UINT64 ImagePteIndex,
        UINT64 SessionId,
        UINT64 DesiredProtection,
        UINT64 PageFrameIndex){
  unsigned int v8; 
  _MI_IMAGE_SECURITY_REFERENCE *SeImageStub; 
  _MMPFN *v11; 
  VOID *v12; 
  UINT64 v13; 
  int v14; 
  __int64 v15; 
  __int64 v16; 
  int v17; 
  UINT64 v18; 
  void *v19; 
  int v20; 
  int v21; 
  UINT64 v22; 
  VOID *v23; 
  VOID *v24; 
  _KTBFLUSH_TYPE v25; 
  int v26; 
  UINT64 v27; 
  NTSTATUS result; 
  UINT64 v29; 
  UINT64 ValidateFlags; 
  char SessionIda; 
  __int64 PageFrameIndexa; 
  int v35; 

  v8 = ImagePteIndex;
  SeImageStub = ControlArea->u2.SeImageStub;
  v11 = &MmGetPfnDb()[PageFrameIndex];
  v12 = (VOID *)(SeImageStub->SecurityContext.Value & 0xFFFFFFFFFFFFFFF8ui64);
  if( (ControlArea->u2.WritableUserReferences & 0xC0000) != 0 && !SeImageStub->StrongImageReference )
  {
    result = MiGetSectionStrongImageReference((INT64)ControlArea->u2.SeImageStub);
    if( result < 0 )
      return result;
  }
  v13 = (UINT64)MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), 1ui64);
  if( v13 )
  {
    SessionIda = 0;
  }
  else
  {
    if( ((MiFlags & 0x4000) == 0 || (ControlArea->u2.WritableUserReferences & 0xC0000) == 0) && v8 != -1 )
      return -1073741670;
    LODWORD(v29) = MiReserveFaultPte();
    v13 = v29;
    if( !v29 )
      return -1073741670;
    SessionIda = 1;
  }
  PageFrameIndexa = (__int64)((v13 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  MiMakeProtectionPfnCompatible((_BYTE *)1, v11);
  LODWORD(v15) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v13, PageFrameIndex, v14 | 0x20000000u);
  v16 = v15;
  LOBYTE(v17) = MiPteInShadowRange(v13);
  if( v17 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v16 & 1) != 0 )
    v16 |= 0x8000000000000000ui64;
  *(_QWORD *)v13 = v16;
  v19 = 0i64;
  v20 = v35 | 2;
  if( (DesiredProtection & 2) == 0 )
    v20 = v35;
  if( (MiFlags & 0x4000) != 0 && (ControlArea->u2.WritableUserReferences & 0xC0000) != 0 )
  {
    v21 = v20;
    if( v8 != -1 )
    {
      v23 = (VOID *)PageFrameIndexa;
      if( SeImageStub->DynamicRelocations )
        v21 = v20 | 1;
      goto LABEL_12;
    }
    goto LABEL_23;
  }
  v21 = v20;
  if( v8 == -1 )
  {
LABEL_23:
    v23 = (VOID *)PageFrameIndexa;
LABEL_12:
    LODWORD(ValidateFlags) = v21;
    v26 = SeValidateImageData(v12, v23, 0x1000ui64, FileOffset, ValidateFlags, CallingProcess);
    if( v26 < 0 )
    {
      _InterlockedIncrement(&dword_140C4C9DC);
    }
    else
    {
      v27 = 0i64;
      if( (MiFlags & 0x40000) != 0
        && (ControlArea->u2.WritableUserReferences & 0xC0000) == 0
        && (((unsigned __int8)v11->TreeNode.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 5) & 2) != 0 )
      {
        v27 = 3i64;
      }
      if( (*(_DWORD *)(&v11->3 + 1) & 0x400i64) != 0 )
        MiMarkPfnVerified(v11, v27);
    }
    goto LABEL_16;
  }
  v22 = v8;
  v23 = (VOID *)PageFrameIndexa;
  v24 = MiRevertRelocatedImagePfn((VOID *)PageFrameIndexa, (ULONG_PTR)ControlArea, v22, v18);
  v19 = v24;
  if( v24 == (VOID *)-1i64 )
  {
    v19 = 0i64;
LABEL_11:
    v21 = v20;
    goto LABEL_12;
  }
  if( v24 )
  {
    v23 = v24;
    goto LABEL_11;
  }
  v26 = -1073741670;
LABEL_16:
  if( SessionIda )
    MiReleaseFaultPte((_XSTATE_CONFIGURATION *)v13);
  else
    MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), (_MMPTE *)v13, 1ui64, v25);
  if( v19 )
    ExFreePoolWithTag(v19, 0);
  return v26;
}

Referenced by: