MiInitializeWalkBounds
__int64 __fastcall MiInitializeWalkBounds(__int64 a1, _LIST_ENTRY **a2){
__int64 v2;
unsigned int v3;
__int64 v4;
__int64 result;
if( (*(_WORD *)a1 & 0x800) != 0 )
{
*a2 = 0i64;
a2[1] = (_LIST_ENTRY *)((char *)&MmGetPteBase()[-1].u.Trans._bf_0 + 7);
a2[2] = (_LIST_ENTRY *)0xFFFFF70000000000i64;
result = 2i64;
a2[3] = (_LIST_ENTRY *)-1i64;
}
else
{
v2 = *(_QWORD *)(a1 + 24);
v3 = 1;
switch( *(_BYTE *)(v2 + 184) & 7 )
{
case 0:
*a2 = 0i64;
a2[1] = (_LIST_ENTRY *)0x7FFFFFFFFFFFi64;
a2[2] = (_LIST_ENTRY *)*(&stru_140C4DB30 + 174);
v4 = *(&stru_140C4DB30 + 176);
if( !*(&stru_140C4DB30 + 176) )
{
v4 = 276840448i64;
*(&stru_140C4DB30 + 178) = 0x10000000i64;
*(&stru_140C4DB30 + 176) = 276840448i64;
*(&stru_140C4DB30 + 177) = 276824064i64;
}
v3 = 2;
a2[3] = (_LIST_ENTRY *)(*(&stru_140C4DB30 + 174) - 1i64 + v4);
return v3;
case 1:
*a2 = (_LIST_ENTRY *)qword_140C4DB18;
a2[1] = (_LIST_ENTRY *)(qword_140C4DB18 + 0x7FFFFFFFFFi64);
return 1i64;
case 2:
*a2 = (_LIST_ENTRY *)*(&stru_140C4DB30 + 125);
result = 1i64;
a2[1] = (_LIST_ENTRY *)(*(&stru_140C4DB30 + 125) - 1i64 + (*(&stru_140C4DB30 + 121) << 21));
break;
case 3:
*a2 = (_LIST_ENTRY *)*(&stru_140C4DB30 + 116);
result = 1i64;
a2[1] = (_LIST_ENTRY *)(*(&stru_140C4DB30 + 116) - 1i64 + (*(&stru_140C4DB30 + 112) << 21));
break;
case 4:
*a2 = (_LIST_ENTRY *)*(&stru_140C4DB30 + 98);
result = 1i64;
a2[1] = (_LIST_ENTRY *)(*(&stru_140C4DB30 + 98) - 1i64 + (*(&stru_140C4DB30 + 94) << 21));
break;
case 6:
*a2 = (_LIST_ENTRY *)*(&stru_140C4DB30 + 80);
result = 1i64;
a2[1] = (_LIST_ENTRY *)(*(&stru_140C4DB30 + 80) - 1i64 + (*(&stru_140C4DB30 + 76) << 21));
break;
default:
return v3;
}
}
return result;
}Referenced by:
MiGenerateRandomPte
MiWalkPageTables