MiTrimPte

NTSTATUS __fastcall MiTrimPte(INT64 a1, UINT64 a2, INT64 a3){
  int v3; 
  _MMSUPPORT_INSTANCE *v6; 
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  _BOOL4 v9; 
  UINT64 v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  int v13; 
  _MMPTE *v14; 
  unsigned __int64 v15; 
  _MMPFN *v16; 
  __int64 Blink; 
  _MMPTE *PteBase; 
  unsigned __int64 v19; 
  unsigned int v20; 
  _MMSUPPORT_INSTANCE *v21; 
  unsigned int v22; 
  _MMPTE *v23; 
  INT64 v24; 
  int v27; 

  v27 = 0;
  v3 = a3;
  v6 = *(_MMSUPPORT_INSTANCE **)(a1 + 24);
  v7 = *(_QWORD *)a2;
  v8 = (__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  v9 = a3 == 0;
  v10 = *(_QWORD *)(a1 + 168);
  v11 = *(_QWORD *)(v10 + 16);
  v12 = *(_QWORD *)(v10 + 8);
  if( v11 == v12 )
    return 3;
  v13 = *(_DWORD *)v10;
  if( (*(_DWORD *)v10 & 0x400) != 0
    && ((v13 & 0x800) != 0 && v11 >= 0x100 || v6->WorkingSetSize <= *(_QWORD *)(v10 + 48) - v12) )
  {
    return 3;
  }
  if( (v13 & 0x1000) == 0 )
  {
    LODWORD(v14) = MiComputeNextWalkPte(a2, v9);
    v6->VmWorkingSetList->NextPteToTrim = v14;
  }
  v15 = *(_QWORD *)a2;
  MiPteInShadowRange(a2);
  v16 = &MmGetPfnDb()[(v15 >> 12) & 0xFFFFFFFFFi64];
  if( v3 && ((v16->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) != 1 || (unsigned int)MiIsPageTableLocked((INT64)v6, a2)) )
    return 0;
  if( (v16->u4._bf_0 & 0x1000000000i64) == 0 )
  {
    Blink = (__int64)v16->ListEntry.Blink;
    if( Blink > 0 && MiDemoteCombinedPte(v6, (_MMPTE *)a2, (_MMPTE *)(Blink | 0x8000000000000000ui64)) == 1 )
      LOBYTE(v7) = MI_READ_PTE_LOCK_FREE(a2);
  }
  PteBase = MmGetPteBase();
  if( v8 < (unsigned __int64)PteBase || v8 > (unsigned __int64)MmGetPteLimit() )
  {
    v20 = HIBYTE(*(unsigned __int64 *)((char *)&PteBase->u.Long + ((v8 >> 9) & 0x7FFFFFFFF8i64))) & 0xF;
  }
  else
  {
    LODWORD(v19) = MI_READ_PTE_LOCK_FREE((INT64)PteBase + ((v8 >> 9) & 0x7FFFFFFFF8i64));
    v20 = (LODWORD(MmGetPfnDb()[(v19 >> 12) & 0xFFFFFFFFFi64].ListEntry.Flink) >> 1) & 7;
  }
  v21 = *(_MMSUPPORT_INSTANCE **)(a1 + 24);
  v22 = *(_DWORD *)v10 & 0xF;
  if( !(unsigned int)MiTrimThisWsle((__int64)v21, v8, (__int64)v16, (wchar_t *)v10, (v7 & 0x20) != 0, &v27) )
    goto LABEL_26;
  MiInsertTbFlushEntry((_MI_TB_FLUSH_LIST *)(v10 + 56), (VOID *)v8, 1ui64, 0i64);
  if( (*(_DWORD *)v10 & 0x10) != 0 )
    MI_WSLE_LOG_ACCESS(v21, (_MMWSLE *)a2, v23);
  if( ++*(_QWORD *)(v10 + 16) == *(_QWORD *)(v10 + 8) || *(_DWORD *)(v10 + 68) == *(_DWORD *)(v10 + 64) )
  {
    v24 = a1;
    MiTrimWorkingSetBuildup((_MMMOD_WRITER_MDL_ENTRY *)a1, v10);
    if( *(_QWORD *)(v10 + 16) == *(_QWORD *)(v10 + 8) )
      return 3;
  }
  else
  {
LABEL_26:
    v24 = a1;
  }
  if( v27 && MiInsertVmAccessedEntry(*(UINT64 **)(v10 + 240), v8) )
  {
    MiTrimWorkingSetTail(v24);
    return 0;
  }
  if( v20 < v22 )
    return 0;
  if( ++*(_QWORD *)(v10 + 32) < *(_QWORD *)(v10 + 40) )
    return 0;
  return 3;
}

Referenced by: