MiAllocateFromSubAllocatedRegion

NTSTATUS MiAllocateFromSubAllocatedRegion(UINT64 ecx0, INT64 a2, UINT64 *a3, ...){
  __int64 v3; 
  unsigned __int64 v4; 
  _MMVAD_SHORT *v5; 
  VOID *v6; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  __int64 p_NextPteToAge; 
  __int64 v10; 
  INT64 v11; 
  __int64 *v12; 
  UINT64 ClearBitsAndSet; 
  UINT64 v14; 
  int v15; 
  unsigned int v16; 
  _MMVAD_SHORT *v17; 
  int NewSubAllocatedRegion; 
  __int64 *v20; 
  __int64 **v21; 
  UINT64 *ChangeProtection; 
  INT64 v23; 
  INT64 v24; 
  INT64 v25; 
  __int64 v26; 
  unsigned int v27; 
  INT64 v30; 
  va_list va1; 
  va_list va; 

  va_start(va1, a3);
  va_start(va, a3);
  v30 = va_arg(va1, _QWORD);
  v27 = ecx0;
  v3 = (int)ecx0;
  v4 = (unsigned __int64)(a2 + 4095) >> 12;
  LODWORD(v24) = 0;
  v5 = 0i64;
  LOWORD(v30) = 0;
  v6 = 0i64;
  *a3 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  p_NextPteToAge = (__int64)&Process->Vm.Instance.VmWorkingSetList[1].NextPteToAge;
  --CurrentThread->Tcb.SpecialApcDisable;
  v26 = p_NextPteToAge;
  LOCK_ADDRESS_SPACE(CurrentThread, Process);
  if( (Process->Flags & 0x20) != 0 )
  {
    NewSubAllocatedRegion = -1073741558;
LABEL_16:
    UNLOCK_ADDRESS_SPACE(CurrentThread, Process);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    return NewSubAllocatedRegion;
  }
  v10 = 2 * (v3 + 17);
  v11 = p_NextPteToAge + 16 * (v3 + 17);
  v25 = v11;
  while( 2 )
  {
    LOCK_PAGE_TABLE_COMMITMENT(CurrentThread, Process);
    v12 = *(__int64 **)(p_NextPteToAge + 8 * v10);
    while( v12 != (__int64 *)v11 )
    {
      ClearBitsAndSet = RtlFindClearBitsAndSetEx(
                          (_RTL_BITMAP_EX *)v12 - 1,
                          v4,
                          (unsigned __int64)*((unsigned int *)v12 + 8) >> 2);
      v14 = ClearBitsAndSet;
      if( ClearBitsAndSet != -1i64 )
      {
        *((_DWORD *)v12 + 6) += v4;
        v15 = v12[4] & 3 | (4 * (v4 + ClearBitsAndSet));
        v16 = *((_DWORD *)v12 + 6);
        *((_DWORD *)v12 + 8) = v15;
        if( v16 >= *((_DWORD *)v12 + 7) )
        {
          v20 = (__int64 *)*v12;
          if( *(__int64 **)(*v12 + 8) != v12 || (v21 = (__int64 **)v12[1], *v21 != v12) )
            __fastfail(3u);
          *v21 = v20;
          v20[1] = (__int64)v21;
          *v12 = 0i64;
        }
        v5 = (_MMVAD_SHORT *)v12[2];
        v11 = v25;
        v6 = (VOID *)((v14 << 12) + ((v5->StartingVpn | ((unsigned __int64)v5->StartingVpnHigh << 32)) << 12));
        break;
      }
      v12 = (__int64 *)*v12;
      v11 = v25;
    }
    UNLOCK_PAGE_TABLE_COMMITMENT(CurrentThread, Process);
    if( !v5 )
    {
      NewSubAllocatedRegion = MiAllocateNewSubAllocatedRegion(v27, v4);
      if( NewSubAllocatedRegion >= 0 )
      {
        p_NextPteToAge = v26;
        continue;
      }
      goto LABEL_16;
    }
    break;
  }
  MiReferenceVad(v5);
  UNLOCK_ADDRESS_SPACE(CurrentThread, Process);
  MiLockVad(CurrentThread, v5);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( !MiVadDeleted(v5) )
  {
    LOBYTE(v23) = 0;
    LODWORD(ChangeProtection) = 0;
    NewSubAllocatedRegion = MiCommitExistingVad(
                              v17,
                              v6,
                              a2,
                              (v5->u.LongFlags >> 7) & 0x1F,
                              ChangeProtection,
                              0i64,
                              v23,
                              0i64,
                              (INT64)&v24,
                              (INT64)va,
                              v24,
                              v25);
    if( NewSubAllocatedRegion < 0 )
    {
      MiFreeToSubAllocatedRegion(v5);
    }
    else
    {
      MiUnlockAndDereferenceVad(v5);
      *a3 = (UINT64)v6;
    }
    return NewSubAllocatedRegion;
  }
  MiUnlockAndDereferenceVad(v17);
  return -1073741558;
}

Referenced by: