MiInsertPhysicalPteMapping

NTSTATUS __stdcall MiInsertPhysicalPteMapping(UINT64 a1, ULONG_PTR BugCheckParameter2, UINT64 ProtectionMask){
  unsigned int v4; 
  UINT64 v5; 
  unsigned __int64 v6; 
  _MI_PFN_CACHE_ATTRIBUTE v7; 
  unsigned __int64 v8; 
  _RTL_BALANCED_NODE *v9; 
  int v10; 
  __int64 v11; 
  __int64 v12; 
  int v13; 
  _MMPTE *PteBase; 
  VOID *v15; 
  unsigned __int64 *v16; 
  unsigned __int64 v17; 
  volatile signed __int32 *p_u2; 
  NTSTATUS result; 
  _MMPFN *v20; 
  unsigned __int8 v21; 
  unsigned int v22; 
  UINT64 SpinCount; 

  v4 = ProtectionMask;
  v5 = *(_QWORD *)&BugCheckParameter2;
  v7 = MiProtectionToCacheAttribute((unsigned int)ProtectionMask);
  if( v6 <= 0xFFFFFFFFFi64 && (v8 = v6, (((unsigned __int64)MmGetPfnDb()[v8].u4._bf_0 >> 50) & 1) != 0) )
  {
    v20 = &MmGetPfnDb()[v8];
    if( !v20->u3.ReferenceCount )
      MiShowBadMapper(v5, 4ui64);
    v21 = *((_BYTE *)&v20->u3 + 2);
    if( (v21 & 0xC0) == 0xC0 )
    {
      MiAssignInitialPageAttribute(v20, v7);
      v21 = *((_BYTE *)&v20->u3 + 2);
    }
    if( v21 >> 6 != v7 )
    {
      MiMakeProtectionPfnCompatible((_BYTE *)v4, v20);
      v4 = v22;
    }
  }
  else
  {
    v9 = MiLookupIoPageNode(v5);
    if( !v9 )
      KeBugCheckEx(0x1Au, (PVOID)0x61949, (PVOID)v5, (PVOID)1, 0i64);
    v4 &= 7u;
    v10 = *((unsigned __int16 *)v9[2].Children[0]->Children + (v5 & 0xFFFFFFFFFi64) - v9[1].ParentValue) >> 14;
    if( v10 )
    {
      if( v10 == 2 )
        v4 |= 0x18u;
    }
    else
    {
      v4 |= 8u;
    }
  }
  LODWORD(v11) = MiMakeValidPte((_XSTATE_CONFIGURATION *)a1, v5, v4 | 0x80000000);
  v12 = v11;
  LOBYTE(v13) = MiPteInShadowRange(a1);
  if( v13 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v12 & 1) != 0 )
    v12 |= 0x8000000000000000ui64;
  *(_QWORD *)a1 = v12;
  PteBase = MmGetPteBase();
  LODWORD(v15) = MiGetUsedPtesHandle((PSLIST_ENTRY)((__int64)((a1 << 25) - ((_QWORD)PteBase << 25)) >> 16));
  MiIncreaseUsedPtesCount(v15, (VOID *)1);
  v16 = (unsigned __int64 *)((char *)&PteBase->u.Long + ((a1 >> 9) & 0x7FFFFFFFF8i64));
  v17 = *v16;
  MiPteInShadowRange((UINT64)v16);
  LODWORD(SpinCount) = 0;
  p_u2 = (volatile signed __int32 *)&MmGetPfnDb()[(v17 >> 12) & 0xFFFFFFFFFi64].u2;
  while( _interlockedbittestandset64(p_u2, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( *(__int64 *)p_u2 < 0 );
  }
  result = -1;
  *(_QWORD *)p_u2 ^= (*(_QWORD *)p_u2 ^ (*(_QWORD *)p_u2 + 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
  _InterlockedAnd64((volatile signed __int64 *)p_u2, 0x7FFFFFFFFFFFFFFFui64);
  return result;
}

Referenced by: