MiResetAccessBitPte

NTSTATUS __fastcall MiResetAccessBitPte(INT64 a1, _MMPTE *PointerPte, int a3){
  __int64 v3; 
  _MMSUPPORT_INSTANCE *v5; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v7; 
  _MMPFN *v9; 
  __int64 Blink; 
  UINT64 *v11; 
  unsigned __int64 v12; 
  int VaAge; 
  int v15; 
  __int64 v16; 
  unsigned __int64 v17; 
  _MI_TB_FLUSH_LIST *TbFlushList; 
  UINT64 AccessLogging; 
  UINT64 Long; 

  v3 = *(_QWORD *)(a1 + 168);
  v5 = *(_MMSUPPORT_INSTANCE **)(a1 + 24);
  v7.Long = (unsigned __int64)PointerPte->u;
  Long = v7.Long;
  if( (v7.Long & 0x20) == 0 )
    return 0;
  MiPteInShadowRange((UINT64)&Long);
  v9 = &MmGetPfnDb()[(v7.Long >> 12) & 0xFFFFFFFFFi64];
  if( a3 )
  {
    if( (v9->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) != 1 || (unsigned int)MiIsPageTableLocked((INT64)v5, (UINT64)PointerPte) )
      return 0;
  }
  if( (v9->u4._bf_0 & 0x1000000000i64) == 0 )
  {
    Blink = (__int64)v9->ListEntry.Blink;
    if( Blink > 0 )
      MiDemoteCombinedPte(v5, PointerPte, (_MMPTE *)(Blink | 0x8000000000000000ui64));
  }
  v11 = *(UINT64 **)(v3 + 16);
  v12 = (__int64)(((_QWORD)PointerPte << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( !v11 || v12 > 0x7FFFFFFEFFFFi64 )
  {
    VaAge = (unsigned __int8)MiGetVaAge((INT64)v11, v12);
    if( VaAge == 7 && (unsigned int)MiGetPfnPriority(v9) < *(&stru_140C4DB30 + 655) )
    {
      v15 = 0;
    }
    else
    {
      v15 = 1;
      if( (unsigned int)(VaAge - 1) <= 5 )
        MiSetVaAgeList(v5, v12, 1ui64, 0);
    }
    v16 = *(_QWORD *)(v3 + 8);
    LODWORD(AccessLogging) = 0;
    LODWORD(TbFlushList) = *(_DWORD *)v3;
    if( !MiClearPteAccessed(v5, v9, PointerPte, (_MMWSLE *)v16, TbFlushList, AccessLogging) )
      return 0;
    if( v15 == 1 && *(_DWORD *)v3 )
    {
      if( !v16 )
      {
        MiLogPageAccess(v5, PointerPte);
        return 0;
      }
    }
    else if( !v16 )
    {
      return 0;
    }
    v17 = *(&stru_140C4DB30 + 52);
    if( (*(_BYTE *)(v16 + 4) & 2) == 0 && *(_DWORD *)v16 == 1 && KeGetCurrentThread()->ApcState.Process->VmContext )
      v17 = -1i64;
    if( (*(_DWORD *)(v16 + 12) >= *(_DWORD *)(v16 + 8) || *(_BYTE *)(v16 + 5) || *(_QWORD *)(v16 + 16) > v17)
      && v17 >= 0x400
      && !*(_BYTE *)(v16 + 5) )
    {
      MiFlushTbList((_MI_TB_FLUSH_LIST *)v16);
    }
    return 0;
  }
  if( MiInsertVmAccessedEntry(v11, v12) )
    return MiResetAccessBitsTail(a1);
  return 0;
}

Referenced by: