MiSetPagingOfDriver

VOID __stdcall MiSetPagingOfDriver(_KLDR_DATA_TABLE_ENTRY *DataTableEntry, _MMPTE *PointerPte, _MMPTE *LastPte){
  _KLDR_DATA_TABLE_ENTRY *v4; 
  __int64 v5; 
  _MMPTE *v6; 
  __int64 v7; 
  char *v8; 
  VOID *v9; 
  _MMSUPPORT_INSTANCE *v10; 
  char v11; 
  UINT64 v12; 
  char v13; 
  UINT64 v14; 
  INT64 v15; 
  char WsleContents; 
  __int64 v17; 
  PVOID DllBase; 
  __int16 v19; 
  _MMPTE *v20; 
  int v21; 
  UINT64 v22; 
  int v23; 
  UINT64 v24; 
  __int64 v25; 
  __int64 v26; 
  __int64 v27; 
  NTSTATUS HasShadow; 
  char v29; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  UINT64 v31; 
  _MMPTE *LastPtea; 
  _KLDR_DATA_TABLE_ENTRY *v33; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  LastPtea = LastPte;
  v4 = DataTableEntry;
  v33 = DataTableEntry;
  memset(TbFlushList, 0i64, 0xB8u);
  v5 = 0i64;
  TbFlushList[2] = 20;
  v6 = 0i64;
  v7 = (__int64)(((_QWORD)PointerPte << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  *(_QWORD *)&TbFlushList[6] = 0i64;
  v8 = 0i64;
  AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v9);
  v10 = AnyMultiplexedVm;
  MiLockLoaderEntry((INT64)&v4[1], (_XSTATE_CONFIGURATION *)2);
  MiLockWorkingSetShared();
  v29 = v11;
  if( PointerPte <= LastPtea )
  {
    do
    {
      if( !v8 || ((unsigned __int16)PointerPte & 0xFFF) == 0 )
      {
        if( v6 )
        {
          MiFlushTbList(TbFlushList);
          LODWORD(v27) = MiTrimSystemImagePages(v6, PointerPte - 1);
          v5 += v27;
          v6 = 0i64;
        }
        if( v8 )
          MiUnlockPageTableInternal((INT64)v10, (UINT64)v8);
        v8 = (char *)MmGetPteBase() + (((unsigned __int64)PointerPte >> 9) & 0x7FFFFFFFF8i64);
        MiLockPageTableInternal((INT64)v10, (UINT64)v8, 0i64);
      }
      MiDriverPageMustStayResident(v4, PointerPte);
      if( !v13 )
      {
        LODWORD(v14) = MI_READ_PTE_LOCK_FREE((INT64)PointerPte);
        v31 = v14;
        if( (v14 & 1) != 0 )
        {
          MiPteInShadowRange((UINT64)&v31);
          WsleContents = MiGetWsleContents(v15, v7);
          if( (WsleContents & 0xF) == 9 )
          {
            v19 = *(_WORD *)(v17 + 32);
            if( v19 == 1 || (v12 = 2i64, v19 == 2) && (*(_BYTE *)(v17 + 34) & 8) != 0 )
            {
              v20 = PointerPte;
              if( v6 )
                v20 = v6;
              v6 = v20;
              MiWriteWsle((INT64)v20, v7, WsleContents & 0xF0 | 0xA);
              v21 = 0;
              v22 = v31 & 0xFFFFFFFFFFFFFBFEui64 | 0x400;
              v31 = v22;
              LOBYTE(v23) = MiPteInShadowRange((UINT64)PointerPte);
              if( v23 )
              {
                HasShadow = MiPteHasShadow();
                v24 = 1i64;
                if( HasShadow )
                  v21 = 1;
              }
              else
              {
                v24 = 1i64;
              }
              PointerPte->u.Long = v22;
              if( v21 )
                MiWritePteShadow();
              MiInsertTbFlushEntry(TbFlushList, (VOID *)v7, v24, 0i64);
              v4 = v33;
            }
          }
        }
        else if( (v14 & 0x400) != 0 && v6 )
        {
          MiFlushTbList(TbFlushList);
          LODWORD(v25) = MiTrimSystemImagePages(v6, PointerPte - 1);
          v5 += v25;
          v6 = 0i64;
        }
        v10 = AnyMultiplexedVm;
      }
      ++PointerPte;
      v7 += 4096i64;
    }
    while( PointerPte <= LastPtea );
    if( v6 )
    {
      MiFlushTbList(TbFlushList);
      LODWORD(v26) = MiTrimSystemImagePages(v6, LastPtea);
      v5 += v26;
    }
    if( v8 )
      MiUnlockPageTableInternal((INT64)v10, (UINT64)v8);
    v11 = v29;
  }
  LOBYTE(v12) = v11;
  MiUnlockWorkingSetShared(v10, v12);
  MiUnlockLoaderEntry((INT64)&v4[1], 2i64);
  if( v5 )
  {
    DllBase = v4->DllBase;
    if( DllBase == PsHalImageBase || DllBase == (PVOID)PsNtosImageBase )
      _InterlockedExchangeAdd((_DWORD *)&xmmword_140C4CA88 + 2, v5);
    else
      _InterlockedExchangeAdd((_DWORD *)&xmmword_140C4CA88 + 3, v5);
  }
}

Referenced by: