NtMapUserPhysicalPages

NTSTATUS __stdcall NtMapUserPhysicalPages(VOID *VirtualAddress, UINT64 NumberOfPages, UINT64 *UserPfnArray){
  INT64 v3; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v7; 
  VOID *v8; 
  INT64 v9; 
  char *Pool; 
  int v11; 
  _MMPTE *AweNode; 
  _EX_CALLBACK_ROUTINE_BLOCK *Long; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  _MMPTE *PteAddress; 
  __int64 v21; 
  int v22; 
  VOID *v23; 
  INT64 v24; 
  INT64 *v25; 
  __int64 v26; 
  INT64 a5; 
  INT64 a6; 
  INT64 a7; 
  INT64 v30; 
  VOID *LockHandle; 
  INT64 v32[2]; 
  char Destination[4096]; 

  *(_OWORD *)v32 = 0i64;
  if( NumberOfPages - 1 > 0xFFFFFFFFFFFFEi64 )
    return -1073741584;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = (unsigned __int64)VirtualAddress & 0xFFFFFFFFFFFFF000ui64;
  v8 = 0i64;
  v9 = 0i64;
  Pool = 0i64;
  if( !UserPfnArray )
    goto LABEL_6;
  if( NumberOfPages > 0x200 )
  {
    Pool = (char *)MiAllocatePool(64i64, 8 * NumberOfPages, 0x77526D4Dui64);
    if( !Pool )
      return -1073741670;
  }
  else
  {
    Pool = Destination;
  }
  v11 = MiCaptureUlongPtrArray(Pool, UserPfnArray, NumberOfPages, v3, a5, a6, a7, v30);
  if( v11 >= 0 )
  {
LABEL_6:
    LockHandle = MiLockAweVadsShared(&CurrentThread->Tcb);
    AweNode = MiGetAweNode(v7);
    v9 = (INT64)AweNode;
    if( !AweNode )
      goto LABEL_7;
    Long = (_EX_CALLBACK_ROUTINE_BLOCK *)AweNode[4].u.Long;
    LODWORD(v15) = MiGetAweViewPageSize((INT64)AweNode);
    v17 = v15;
    if( !v15 )
    {
      ExGetCallBackBlockRoutine(Long);
      v17 = v18;
    }
    if( v17 == 1 || (((v17 << 12) - 1) & v7) == 0 )
    {
      v19 = ((v17 * NumberOfPages) << 12) + v7 - 1;
      if( v19 > v7 )
      {
        if( v7 < (*(unsigned int *)(v16 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 32) << 32)) << 12
          || v19 > (((*(unsigned int *)(v16 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v16 + 33) << 32)) << 12) | 0xFFF) )
        {
          v11 = -1073741585;
        }
        else
        {
          PteAddress = MiGetPteAddress((VOID *)v7);
          if( v21 == 512 )
          {
            do
              PteAddress = MiGetPteAddress(PteAddress);
            while( v22 != 1 );
          }
          LODWORD(v23) = MiLockAwePagesShared((INT64)Long, (INT64)CurrentThread);
          v8 = v23;
          if( !Pool
            || (v11 = MiReferenceIncomingPhysicalPages(
                        Long,
                        (INT64)Pool,
                        NumberOfPages,
                        0i64,
                        (INT64)v32,
                        v9,
                        (INT64)PteAddress),
                v11 >= 0) )
          {
            LODWORD(v24) = MiWriteAwePtes(v9, (INT64)Pool, NumberOfPages, 0i64, (UINT64)PteAddress, 1);
            v32[1] = v24;
            v11 = 0;
          }
        }
        if( v8 )
          MiUnlockAweVadsShared(&CurrentThread->Tcb, v8);
      }
      else
      {
        v11 = -1073741584;
      }
    }
    else
    {
LABEL_7:
      v11 = -1073741585;
    }
    if( LockHandle )
      MiUnlockAweVadsShared(&CurrentThread->Tcb, LockHandle);
  }
  v25 = v32;
  v26 = 2i64;
  do
  {
    if( *v25 )
      MiFreePhysicalPageChain(v9, *v25, 0i64);
    ++v25;
    --v26;
  }
  while( v26 );
  if( UserPfnArray )
  {
    if( Pool != Destination )
      ExFreePoolWithTag(Pool, 0);
  }
  return v11;
}

Referenced by: