MiMakeLargePageTable

NTSTATUS __stdcall MiMakeLargePageTable(INT64 a1, INT64 *a2, INT64 a3){
  INT64 v3; 
  unsigned __int64 v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  unsigned __int64 v8; 
  INT64 v9; 
  unsigned __int64 v10; 
  __int64 v11; 
  INT64 v12; 
  __int64 v13; 
  __int64 v14; 
  _MMPFN *v15; 
  INT64 v16; 
  INT64 v17; 
  int v18; 
  NTSTATUS result; 

  v3 = *(_QWORD *)(a1 + 168);
  v5 = (int)a3;
  if( (*(_DWORD *)(v3 + 64) & 0x80u) == 0 )
    return 0;
  if( (unsigned int)(a3 - 1) > 1 )
    return 0;
  LODWORD(v6) = MiGetLeafVa((UINT64)a2);
  v8 = v6;
  if( v6 < *(_QWORD *)(v7 + 32) )
    return 0;
  v9 = 1i64;
  if( v5 > 1 )
  {
    v10 = v5 - 1;
    do
    {
      v9 = (unsigned int)(v9 - 1);
      --v10;
    }
    while( v10 );
  }
  v11 = (unsigned int)v9;
  if( v8 + (MiLargePageSizes[(unsigned int)v9] << 12) - 1 > *(_QWORD *)(v7 + 40) )
    return 0;
  v12 = *(_QWORD *)(v3 + 8i64 * (unsigned int)v9);
  if( !v12 )
  {
    if( !(_DWORD)v9 )
      return 0;
    MiDemotePfnListChain(v3, v9);
    v12 = *(_QWORD *)(v3 + 8 * v11);
    if( !v12 )
      return 0;
  }
  *(_QWORD *)(v3 + 8 * v11) = *(_QWORD *)v12;
  LODWORD(v13) = MiGetContainingPageTable((UINT64)a2);
  v14 = v13;
  v15 = &MmGetPfnDb()[v13];
  MiLockPageAtDpc((INT64)v15);
  v15->u2._bf_0 ^= (v15->u2._bf_0 ^ (v15->u2._bf_0 + 1)) & 0x3FFFFFFFFFFFFFFFi64;
  _InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  MiLockPageAtDpc(v12);
  *(_QWORD *)(v12 + 8) = a2;
  *(_QWORD *)(v12 + 16) = MiMakeDemandZeroPte(4);
  MiSetPfnPageState(v12, 6);
  *(_QWORD *)(v12 + 40) ^= (v14 ^ *(_QWORD *)(v12 + 40)) & 0xFFFFFFFFFi64;
  _InterlockedAnd64((volatile signed __int64 *)(v12 + 24), 0x7FFFFFFFFFFFFFFFui64);
  LODWORD(v16) = MiMakeValidPte((_XSTATE_CONFIGURATION *)a2, (v12 - (__int64)MmGetPfnDb()) / 48, 2214592516i64);
  v17 = v16;
  if( (MI_READ_PTE_LOCK_FREE((INT64)a2) & 1) != 0 )
  {
    MiTransformValidPteInPlace(a2, (UINT64)a2, v17, (unsigned int)v5);
  }
  else
  {
    LOBYTE(v18) = MiPteInShadowRange((UINT64)a2);
    if( v18 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v17 & 1) != 0 )
      v17 |= 0x8000000000000000ui64;
    *a2 = v17;
  }
  result = 1;
  *(_QWORD *)(v3 + 48) += MiLargePageSizes[v11];
  return result;
}

Referenced by: