MiGetPhysicalAddress

NTSTATUS __stdcall MiGetPhysicalAddress(VOID *BaseAddress, _LARGE_INTEGER *ReturnedPhysicalAddress, UINT64 *Writable){
  NTSTATUS v6; 
  __int64 v7; 
  __int64 v8; 
  __int64 v9; 
  bool v10; 
  __int64 v11; 
  NTSTATUS result; 
  __int64 v13; 
  INT64 v14; 
  _MMPTE *v15; 
  UINT64 v16; 
  UINT64 v17; 
  UINT64 v18; 
  NTSTATUS SystemRegionType; 
  UINT64 v20; 
  UINT64 v22[2]; 
  __int128 v23; 
  UINT64 v24; 

  *(_DWORD *)Writable = 0;
  *(_OWORD *)v22 = 0i64;
  v23 = 0i64;
  MiFillPteHierarchy((UINT64)BaseAddress, v22);
  v6 = MI_IS_PHYSICAL_ADDRESS(BaseAddress);
  v7 = v6;
  if( v6 )
  {
    LODWORD(v8) = MiVaToPfn(BaseAddress);
    v9 = v8;
    v10 = (MI_READ_PTE_LOCK_FREE(v22[v7]) & 0x800) == 0i64;
  }
  else
  {
    v13 = 4i64;
    do
    {
      v14 = v22[--v13];
      if( (MI_READ_PTE_LOCK_FREE(v14) & 1) == 0 )
        return 0;
    }
    while( v13 != 1 );
    v15 = (_MMPTE *)v22[0];
    LODWORD(v16) = MI_READ_PTE_LOCK_FREE(v22[0]);
    v24 = v16;
    v17 = v16;
    SystemRegionType = MiGetSystemRegionType((UINT64)BaseAddress);
    if( SystemRegionType == 12 )
      MiQueuePinDriverAddressLog((INT64)BaseAddress, v17, 0i64);
    if( (v17 & 1) == 0 )
      return 0;
    if( SystemRegionType == 5 )
    {
      MiSetNonPagedPoolNoSteal(v15, v18);
      LODWORD(v20) = MI_READ_PTE_LOCK_FREE((INT64)v15);
      v17 = v20;
      v24 = v20;
    }
    MiPteInShadowRange((UINT64)&v24);
    v9 = (v17 >> 12) & 0xFFFFFFFFFi64;
    v10 = (v24 & 0x800) == 0;
  }
  if( !v10 )
    *(_DWORD *)Writable = 1;
  v11 = v9 << 12;
  HIDWORD(v24) = HIDWORD(v11);
  result = 1;
  LODWORD(v24) = ((unsigned __int16)BaseAddress & 0xFFF) + v11;
  ReturnedPhysicalAddress->QuadPart = v24;
  return result;
}

Referenced by: