MiGetNextPageTablePte

NTSTATUS __stdcall MiGetNextPageTablePte(INT64 a1, INT64 *a2, INT64 a3){
  INT64 v3; 
  unsigned __int64 v4; 
  __int64 v5; 
  __int16 v7; 
  NTSTATUS result; 
  _MI_TB_FLUSH_LIST *v9; 
  void(__fastcall *v10)(INT64); 
  __int64 BugCheckParameter4; 
  NTSTATUS v12; 
  void *v13; 
  __int64 v14; 
  _MMPTE *v15; 
  unsigned __int64 v16; 
  char *v17; 
  int v18; 
  __int64 v19; 
  _MMPTE *PteBase; 
  unsigned __int64 v21; 
  INT64 v22; 

  v3 = *a2;
  v4 = (unsigned __int64)a2;
  v5 = (int)a3;
  if( (_DWORD)a3 == 3 )
    MiPteInShadowRange((UINT64)a2);
  v22 = v3;
  if( !v3 )
  {
    if( !(_DWORD)v5 )
      return(*(_BYTE *)a1 & 1) != 0;
    return 0;
  }
  if( (v3 & 1) == 0 )
  {
    if( (int)v5 < 1 || (LOBYTE(v18) = MiIsPdeOrAboveAccessible(v4), v18) )
    {
      if( !(_DWORD)v5 )
        return 1;
      if( *(char *)a1 >= 0 )
      {
        v9 = *(_MI_TB_FLUSH_LIST **)(a1 + 16);
        if( v9 )
          MiFlushTbList(v9);
        v10 = *(void(__fastcall **)(INT64))(a1 + 160);
        if( v10 )
          v10(a1);
        if( (*(_BYTE *)(a1 + 2) & 1) == 0 )
          MiReleaseWalkLocks(a1);
        BugCheckParameter4 = (__int64)((v4 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
        v12 = MmAccessFault(
                ((unsigned __int64)*(unsigned int *)(a1 + 8) << 57) | 0x100000000000002i64,
                (PVOID)BugCheckParameter4,
                0,
                0i64);
        v13 = (void *)v12;
        if( v12 < 0 )
        {
          MiFlushAllFilesystemPages();
          KeBugCheckEx(0x7Au, (PVOID)1, v13, KeGetCurrentThread()->ApcState.Process, (PVOID)BugCheckParameter4);
        }
        return 1;
      }
      return 0;
    }
LABEL_33:
    if( (*(_BYTE *)a1 & 0x40) == 0 )
      return 1;
    v19 = *(_QWORD *)(a1 + 168);
    PteBase = MmGetPteBase();
    for( *(_DWORD *)v19 = v5; (_DWORD)v5; LODWORD(v5) = v5 - 1 )
      v4 = (__int64)((v4 << 25) - ((_QWORD)PteBase << 25)) >> 16;
    if( v4 < (unsigned __int64)PteBase + ((*(_QWORD *)(a1 + 32) >> 9) & 0x7FFFFFFFF8i64) )
      v4 = (unsigned __int64)PteBase + ((*(_QWORD *)(a1 + 32) >> 9) & 0x7FFFFFFFF8i64);
    *(_QWORD *)(v19 + 8) = v4;
    return 3;
  }
  if( (_MMPTE *)v4 == MmGetPxeSelfRef() )
    return 0;
  if( (v3 & 0x80u) != 0i64 )
    goto LABEL_33;
  v7 = *(_WORD *)a1;
  if( (*(_WORD *)a1 & 0x200) != 0 && *(&stru_140C4DB30 + 507) != *(&stru_140C4DB30 + 508) )
  {
    LODWORD(v21) = MI_READ_PTE_LOCK_FREE((INT64)&v22);
    if( ((v21 >> 12) & 0xFFFFFFFFFi64) == *((_QWORD *)&stru_140C4DB30 + v5 + 507) )
      return 0;
  }
  if( (int)v5 > ((*(unsigned __int8 *)(a1 + 2) >> 2) & 7) )
    return 2;
  if( (v7 & 0x40) == 0 )
    return 1;
  v14 = *(_QWORD *)(a1 + 168);
  v15 = MmGetPteBase();
  if( (v7 & 4) != 0 )
  {
    MiLockPageTableInternal(*(_QWORD *)(a1 + 24), v4, 0i64);
    MiUnlockPageTableInternal(*(_QWORD *)(a1 + 24), (UINT64)v15 + ((v4 >> 9) & 0x7FFFFFFFF8i64));
    *(_QWORD *)(a1 + 48) = v4;
  }
  v16 = (__int64)((v4 << 25) - ((_QWORD)v15 << 25)) >> 16;
  v17 = (char *)v15 + ((*(_QWORD *)(a1 + 32) >> 9) & 0x7FFFFFFFF8i64);
  result = 3;
  if( v16 >= (unsigned __int64)v17 )
    v17 = (char *)v16;
  *(_QWORD *)(v14 + 8) = v17;
  return result;
}

Referenced by: