MiRemoveWsle
VOID __stdcall MiRemoveWsle(UINT64 Entry, _MMSUPPORT_INSTANCE *Vm){
__int64 v2;
char v3;
char v4;
char v5;
__int64 v6;
unsigned __int64 *v9;
unsigned __int64 PteBase;
_MMPTE *PteLimit;
char v12;
char v13;
unsigned __int8 v14;
int v15;
UINT64 v16;
_MMPFN *v17;
__int64 bf_0;
unsigned __int8 v19;
unsigned __int64 v20;
_KSPIN_LOCK_QUEUE *volatile Next;
_MMSUPPORT_INSTANCE *v22;
__int64 v23;
_KSPIN_LOCK_QUEUE v24;
__int64 v25;
__int128 v26;
__int64 v27;
UINT64 v28;
int v29;
int v30;
v4 = *(_BYTE *)(Entry + 184) & 7;
v25 = 0i64;
v5 = v3;
v6 = v2;
if( v4 == 2 )
v9 = (unsigned __int64 *)((char *)&stru_140C4DB30 + 6608);
else
v9 = (unsigned __int64 *)(Entry + 256);
v24.Lock = v9;
v24.Next = 0i64;
if( _InterlockedExchange64((volatile __int64 *)v9, (__int64)&v24) )
KxWaitForLockOwnerShip((INT64)&v24);
PteBase = (unsigned __int64)MmGetPteBase();
PteLimit = MmGetPteLimit();
if( v30 )
{
*(_QWORD *)(Entry + 144) -= v6;
v26 = 0i64;
v27 = 0i64;
if( (unsigned __int64)Vm < PteBase || Vm > (_MMSUPPORT_INSTANCE *)PteLimit )
*(_QWORD *)(Entry + 128) -= v6;
}
if( (*(_BYTE *)(Entry + 184) & 7) == 4 )
{
if( PsNtosImageBase
&& ((unsigned __int64)Vm < PsNtosImageEnd && (unsigned __int64)Vm >= PsNtosImageBase
|| (unsigned __int64)Vm < PsHalImageEnd && Vm >= PsHalImageBase) )
{
LODWORD(xmmword_140C4CA88) = xmmword_140C4CA88 - v6;
}
else
{
if( MiGetSystemRegionType((UINT64)Vm) == 12
&& MiLookupDataTableEntry(
(VOID *)((__int64)(((PteBase + (((unsigned __int64)Vm >> 9) & 0x7FFFFFFFF8i64)) << 25) - (PteBase << 25)) >> 16),
2ui64) )
{
DWORD1(xmmword_140C4CA88) -= v6;
}
PteLimit = MmGetPteLimit();
}
}
v12 = *(_BYTE *)(Entry + 184);
*(_QWORD *)(Entry + 136) -= v6;
v13 = v12 & 7;
if( (unsigned __int64)Vm < PteBase || Vm > (_MMSUPPORT_INSTANCE *)PteLimit )
{
*(_QWORD *)(Entry + 120) -= v6;
v14 = v5 & 0xF;
v15 = 1;
if( v14 == 8 )
goto LABEL_16;
}
else
{
v15 = 0;
if( v13 )
goto LABEL_16;
v14 = v5 & 0xF;
}
if( (unsigned __int64)Vm < PteBase || Vm > (_MMSUPPORT_INSTANCE *)PteLimit )
{
v16 = *(unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long + (((unsigned __int64)Vm >> 18) & 0x3FFFFFF8));
v28 = v16;
MiPteInShadowRange((UINT64)&v28);
v17 = &MmGetPfnDb()[(v16 >> 12) & 0xFFFFFFFFFi64];
bf_0 = v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
v19 = ((unsigned __int64)v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 14) & 7;
if( (((unsigned __int64)v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 4) & 0x3FF) != 0 )
{
if( v14 == v19 )
{
v20 = bf_0 ^ ((unsigned __int16)bf_0 ^ (unsigned __int16)(16
* ((((unsigned __int64)v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 4) & 0x3FF)
- v6))) & 0x3FF0;
LABEL_13:
v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = v20;
goto LABEL_14;
}
if( v14 > v19 )
{
v20 = bf_0 & 0xFFFFFFFFFFFE000Fui64 | (16 * (-(__int16)v6 & 0x3FF | ((unsigned __int64)(v14 & 7) << 10)));
goto LABEL_13;
}
}
}
LABEL_14:
*(_QWORD *)(Entry + 8i64 * v14 + 40) -= v6;
if( v14 == 7 )
MiVolunteerForTrimFirst((_MMSUPPORT_INSTANCE *)Entry, -v6);
LABEL_16:
if( (*(_BYTE *)(Entry + 184) & 7) == 2 )
{
*(&stru_140C4DB30 + 835) -= v6;
if( v15 == 1 )
*(&stru_140C4DB30 + 836) -= v6;
}
_m_prefetchw(&v24);
Next = v24.Next;
if( v24.Next )
goto LABEL_51;
if( (_KSPIN_LOCK_QUEUE *)_InterlockedCompareExchange64(
(volatile signed __int64 *)v24.Lock,
0i64,
(signed __int64)&v24) != &v24 )
{
Next = KxWaitForLockChainValid(&v24);
LABEL_51:
v24.Next = 0i64;
_InterlockedXor64((volatile signed __int64 *)&Next->Lock, 1ui64);
}
if( v15 == 1
&& (v29 == 9 || v29 == 10 && (*(_BYTE *)((((unsigned __int64)Vm >> 9) & 0x7FFFFFFFF8i64) + PteBase) & 1) != 0) )
{
if( v6 )
{
v22 = Vm;
v23 = v6;
do
{
MiWriteValidPteVolatile((_MMPTE *)(PteBase + (((unsigned __int64)v22 >> 9) & 0x7FFFFFFFF8i64)), 0x80000000ui64);
v22 = (_MMSUPPORT_INSTANCE *)((char *)v22 + 4096);
--v23;
}
while( v23 );
}
}
}Referenced by:
MiConvertPrivateToProto
MiDeleteVa
MiTerminateWsle
MiTerminateWsleCluster