MiSnapDriverRange

NTSTATUS __stdcall MiSnapDriverRange(
        _KLDR_DATA_TABLE_ENTRY *DataTableEntry,
        UINT64 SectionIndex,
        UINT64 Flags,
        _MMPTE **StartPte,
        _MMPTE **EndPte){
  NTSTATUS v5; 
  unsigned int v6; 
  char v8; 
  _BYTE *DllBase; 
  __int64 v10; 
  __int64 v11; 
  char *v12; 
  unsigned __int64 v13; 
  unsigned int v14; 
  unsigned __int64 v15; 
  __int64 v16; 
  _MMPTE *PteAddress; 
  _MMPTE *v18; 
  _IMAGE_SECTION_HEADER *v19; 
  union {unsigned int PhysicalAddress;unsigned int VirtualSize;} v20; 
  __int64 v21; 
  unsigned int v22; 
  NTSTATUS v23; 
  bool v24; 
  __int64 v25; 
  _MMPTE *v26; 
  unsigned __int64 v27; 
  __int16 v28; 
  PVOID v29; 
  int v30; 
  union {unsigned int PhysicalAddress;unsigned int VirtualSize;} v31; 
  _MMPTE *v32; 
  unsigned __int64 VirtualAddress; 
  union {unsigned int PhysicalAddress;unsigned int VirtualSize;} v35; 
  unsigned int v36; 
  char *v37; 
  _BYTE *v39; 
  __int64 v41; 
  __int64 v42; 
  __int64 v43; 
  int v44; 
  __int128 v45; 
  __int64 v46; 
  int v47; 
  _MMPTE **v48; 

  v5 = 0;
  v6 = SectionIndex;
  v43 = 0i64;
  *EndPte = 0i64;
  v8 = Flags;
  v45 = 0i64;
  *v48 = 0i64;
  DllBase = DataTableEntry->DllBase;
  v46 = 0i64;
  v39 = DllBase;
  LODWORD(v10) = RtlImageNtHeader((UINT64)DllBase);
  v11 = v10;
  v41 = v10;
  v12 = (char *)((char *)StartPte - DllBase);
  v13 = *(unsigned int *)(v10 + 56);
  v14 = *(unsigned __int16 *)(v10 + 6);
  v15 = (unsigned int)v13;
  v37 = (char *)((char *)StartPte - DllBase);
  if( v13 > 0x1000 )
    v15 = 4096i64;
  v36 = *(unsigned __int16 *)(v10 + 6);
  if( v6 > v14 )
    return 0;
  v16 = *(unsigned __int16 *)(v10 + 20);
  v42 = v16;
  PteAddress = 0i64;
  v47 = 0x40000000;
  v18 = 0i64;
  DWORD1(v45) = v16 + 40 * v14 + v10 + 24 - (_DWORD)DllBase;
  v44 = DWORD1(v45);
  while( 1 )
  {
    if( v6 )
      v19 = (_IMAGE_SECTION_HEADER *)(v16 + 40i64 * (v6 - 1) + v11 + 24);
    else
      v19 = (_IMAGE_SECTION_HEADER *)&v43;
    v20.PhysicalAddress = v19->SizeOfRawData;
    if( v20.PhysicalAddress < v19->Misc.PhysicalAddress )
      v20.PhysicalAddress = (unsigned int)v19->Misc;
    v35.PhysicalAddress = v20.PhysicalAddress;
    if( !StartPte )
      break;
    VirtualAddress = v19->VirtualAddress;
    if( (unsigned __int64)v12 < VirtualAddress
      || (unsigned __int64)v12 >= (unsigned int)(v20.PhysicalAddress + VirtualAddress) )
    {
      goto LABEL_18;
    }
    if( (v8 & 0x40) != 0 && (v19->Characteristics & 0x2000000) != 0 )
      return 0;
LABEL_24:
    v25 = v19->VirtualAddress;
    if( !PteAddress )
      PteAddress = MiGetPteAddress((VOID *)((unsigned __int64)&DllBase[v25 + 4095] & 0xFFFFFFFFFFFFF000ui64));
    v26 = MiGetPteAddress((VOID *)(-(__int64)v15 & (unsigned __int64)&DllBase[v15 - 1 + v20.PhysicalAddress + v25]));
    v18 = v26;
    if( (v28 & 0xFFF) == 0 || (v8 & 0xC) == 0 || v15 >= 0x1000 )
      v18 = v26 - 1;
    if( v27 > 0x1000 )
      goto LABEL_18;
LABEL_19:
    if( ++v6 > v14 )
    {
      if( PteAddress )
      {
        v31.PhysicalAddress = v19->SizeOfRawData;
        if( v31.PhysicalAddress < v19->Misc.PhysicalAddress )
          v31.PhysicalAddress = (unsigned int)v19->Misc;
        v32 = MiGetPteAddress((VOID *)(((-(__int64)v15 & (unsigned __int64)&DllBase[v15
                                                                                  - 1
                                                                                  + v31.PhysicalAddress
                                                                                  + v19->VirtualAddress])
                                      + 4095) & 0xFFFFFFFFFFFFF000ui64))
            - 1;
        if( PteAddress <= v32 )
        {
          *EndPte = PteAddress;
          *v48 = v32;
        }
      }
      return 0;
    }
    v11 = v41;
    v16 = v42;
  }
  if( (v8 & 8) != 0 )
  {
    v21 = (v19->Characteristics & 0xE0000000) != 0;
    goto LABEL_23;
  }
  if( (v8 & 1) != 0 )
  {
    LODWORD(v21) = MmImageSectionPagable(v19);
    goto LABEL_22;
  }
  if( (v8 & 4) != 0 )
  {
    v22 = v19->Characteristics & 0xE0000000;
    v23 = MmImageSectionPagable(v19);
    v24 = v22 != 0;
    DllBase = v39;
    LODWORD(v21) = v24 && v23 == 0;
LABEL_22:
    v14 = v36;
    v20.PhysicalAddress = v35.PhysicalAddress;
    v12 = v37;
    goto LABEL_23;
  }
  if( (v8 & 0x10) != 0 )
  {
    LODWORD(v21) = v19->Characteristics & 0x20000000;
    goto LABEL_23;
  }
  if( (v8 & 0x20) != 0 )
  {
    if( v19->Name[0] != 80
      || v19->Name[1] != 65
      || v19->Name[2] != 71
      || v19->Name[3] != 69
      || v19->Name[4] != 75
      || v19->Name[5] != 68 )
    {
      goto LABEL_18;
    }
    goto LABEL_24;
  }
  if( !*(_DWORD *)v19->Name && v19 != (_IMAGE_SECTION_HEADER *)&v43 )
    return 0;
  LODWORD(v21) = v19->Characteristics & 0x2000000;
  if( (DataTableEntry->Flags & 0x4000000) != 0 && *(_DWORD *)v19->Name == 1414090313 )
    LODWORD(v21) = 0;
  if( (_DWORD)v21 )
  {
    v29 = DataTableEntry->DllBase;
    if( v29 == (PVOID)PsNtosImageBase || v29 == PsHalImageBase )
    {
      LOBYTE(v30) = MiIsKernelHalPadSection((INT64)v19);
      if( v30 )
        LODWORD(v21) = 0;
    }
LABEL_23:
    if( !(_DWORD)v21 )
      goto LABEL_18;
    goto LABEL_24;
  }
LABEL_18:
  if( !PteAddress )
    goto LABEL_19;
  if( PteAddress > v18 )
  {
    PteAddress = 0i64;
    goto LABEL_19;
  }
  *EndPte = PteAddress;
  *v48 = v18;
  if( v6 + 1 <= v14 )
    return v6 + 1;
  return v5;
}

Referenced by: