MiScanPagefileSpace

VOID __stdcall MiScanPagefileSpace(VOID *Context){
  __int16 v1; 
  int v2; 
  PHYSICAL_MEMORY_DESCRIPTOR *v4; 
  _MMPFN *v5; 
  _MMPFN *v6; 
  _MMPTE *p_OriginalPte; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v8; 
  char v9; 
  _MMPTE v10; 
  UINT8 v11; 
  char v12; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v13; 
  INT64 v14; 
  UINT8 OldIrql; 
  __int16 v16; 
  int v17; 
  PHYSICAL_MEMORY_DESCRIPTOR *v18; 

  v1 = *(_WORD *)Context;
  v16 = *(_WORD *)Context;
  v2 = 0;
  v17 = 0;
  v4 = MiReferencePageRuns((ULONG_PTR *)Context, 0i64);
  v18 = v4;
  do
  {
    v5 = &MmGetPfnDb()[v4->Run[v2].BasePage];
    v6 = &v5[v4->Run[v2].PageCount];
    if( v5 < v6 )
    {
      p_OriginalPte = &v5->OriginalPte;
      do
      {
        v8.Long = (unsigned __int64)p_OriginalPte[3].u;
        if( ((v8.Long >> 39) & 0x3FF) == v1 )
        {
          v9 = BYTE2(p_OriginalPte[2].u.VolatileLong);
          if( (((v9 & 7) - 2) & 0xFA) == 0
            && (v9 & 7) != 6
            && (p_OriginalPte->u.Long & 0x400) == 0
            && MiGetPagingFileOffset(p_OriginalPte)
            && (v8.Long & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64
            && LOWORD(p_OriginalPte[2].u.Long)
            && (v9 & 0x28) == 0
            && (p_OriginalPte[2].u.Hard._bf_0 & 0x10000000) == 0 )
          {
            v10.u.Long = 0i64;
            v11 = MiLockPage(v5);
            v12 = BYTE2(p_OriginalPte[2].u.VolatileLong);
            OldIrql = v11;
            if( (((v12 & 7) - 2) & 0xFA) == 0
              && (v12 & 7) != 6
              && (p_OriginalPte->u.Long & 0x400) == 0
              && MiGetPagingFileOffset(p_OriginalPte)
              && (p_OriginalPte[3].u.Long & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64
              && LOWORD(p_OriginalPte[2].u.Long)
              && (((v12 & 0x28) == 0) & (unsigned __int8)~(BYTE3(p_OriginalPte[2].u.Hard._bf_0) >> 4)) != 0 )
            {
              MiCaptureDirtyBitToPfn();
              v10.u.Long = v13.Long;
            }
            MiUnlockPage(v5, OldIrql);
            if( v10.u.Long )
              MiReleasePageFileInfo((_MI_PARTITION *)Context, v10, 0i64);
          }
          v1 = v16;
        }
        ++v5;
        p_OriginalPte += 6;
      }
      while( v5 < v6 );
      v2 = v17;
      v4 = v18;
    }
    v17 = ++v2;
  }
  while( v2 != v4->NumberOfRuns );
  MiDereferencePageRuns(v4);
  v14 = *((_QWORD *)Context + 22);
  *((_QWORD *)Context + 123) = 0i64;
  PsDereferencePartition(v14);
}

Referenced by: