MiQueryLeafPte

NTSTATUS __stdcall MiQueryLeafPte(_PNP_REPLACEABLE_UNIT *Target, _PNP_REPLACEABLE_UNIT *Spare){
  int v2; 
  __int64 v3; 
  int v4; 
  _PNP_REPLACEABLE_UNIT *v5; 
  unsigned __int64 v6; 
  __int64 v7; 
  INT64 v8; 
  unsigned __int64 v9; 
  _UNICODE_STRING *v10; 
  UINT8 v11; 
  wchar_t *v12; 
  _MMPFN *v13; 
  unsigned __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  _UNICODE_STRING *v17; 
  UINT8 v18; 
  PWCHAR v19; 
  __int16 v20; 
  _UNICODE_STRING *v21; 
  _UNICODE_STRING *v22; 
  PWCHAR v23; 
  int v24; 
  unsigned __int64 v25; 
  __int64 v26; 
  unsigned __int64 v27; 
  __int64 v28; 
  int v29; 
  unsigned __int64 v30; 
  unsigned __int64 v31; 
  int v32; 
  unsigned __int64 v33; 
  __int64 v35; 
  INT64 v36; 

  v3 = *((_QWORD *)Target + 21);
  v4 = v2;
  v5 = Spare;
  v6 = (__int64)(((_QWORD)Spare << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( v6 < *(&stru_140C4DB30 + 174) || (LODWORD(v7) = MiHyperSpaceSize(), v6 >= *(&stru_140C4DB30 + 174) + v7) )
  {
    if( v4 < 1 )
    {
      LODWORD(v8) = MI_READ_PTE_LOCK_FREE((INT64)v5);
      v36 = v8;
      if( (v8 & 1) != 0 )
      {
        LODWORD(v9) = MI_READ_PTE_LOCK_FREE((INT64)&v36);
        v13 = &MmGetPfnDb()[(v9 >> 12) & 0xFFFFFFFFFi64];
        if( (*(_DWORD *)v3 & 1) != 0 )
        {
          v14 = *(_QWORD *)(v3 + 16) + 1i64;
          *(_QWORD *)(v3 + 16) = v14;
          if( v14 < *(_QWORD *)(v3 + 24) )
          {
            v15 = *(_QWORD *)(v3 + 8);
            *(_QWORD *)(v15 + 8 * v14 - 8) = v6 ^ ((unsigned __int16)v6 ^ (unsigned __int16)*(_QWORD *)(v15 + 8 * v14 - 8)) & 0xFFF;
            LODWORD(v16) = MiSearchNumaNodeTable((PVOID)((__int64)(48 * ((v9 >> 12) & 0xFFFFFFFFFi64)) / 48));
            v17 = (_UNICODE_STRING *)(*(_QWORD *)(v15 + 8 * v14 - 8) ^ (*(_DWORD *)(v15 + 8 * v14 - 8) ^ (*(_DWORD *)(v16 + 8) << 9)) & 0xE00);
            *(_QWORD *)(v15 + 8 * v14 - 8) = v17;
            LOBYTE(v20) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v13, v17, v18, v19);
            *(_QWORD *)(v15 + 8 * v14 - 8) = (unsigned __int64)v21 ^ ((unsigned __int16)v21 ^ (unsigned __int16)(v20 << 8)) & 0x100;
            LOBYTE(v24) = MI_PFN_IS_PROTO(v22, v21, (UINT8)v21, v23);
            if( v24 )
            {
              if( (*(_DWORD *)v3 & 2) != 0 )
              {
                v27 = v26 & 0xFFFFFFFFFFFFF11Fui64 | 0xE0;
              }
              else
              {
                LOBYTE(v28) = 7;
                if( (v13->u2._bf_0 & 0x3FFFFFFFFFFFFFFFui64) < 7 )
                  v28 = v13->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64;
                v25 = (unsigned __int8)(v26 ^ (32 * v28)) & 0xE0;
                v27 = v25 ^ v26;
              }
              *(_QWORD *)(v15 + 8 * v14 - 8) = v27;
              MiGetPfnProtection((_MMPFN *)v25, (_MMWSLE *)v6);
              v30 = *(_QWORD *)(v15 + 8 * v14 - 8) ^ (*(_DWORD *)(v15 + 8 * v14 - 8) ^ v29) & 0x1F;
            }
            else
            {
              v31 = v26 & 0xFFFFFFFFFFFFFF1Fui64;
              *(_QWORD *)(v15 + 8 * v14 - 8) = v31;
              v30 = v31 ^ ((unsigned __int8)v31 ^ (unsigned __int8)((unsigned __int64)*((unsigned int *)&v13->3 + 4) >> 5)) & 0x1F;
            }
            *(_QWORD *)(v15 + 8 * v14 - 8) = v30;
            return 0;
          }
          return 4;
        }
        LOBYTE(v32) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v13, v10, v11, v12);
        if( v32 )
        {
          v33 = *(_QWORD *)(v3 + 16) + 1i64;
          *(_QWORD *)(v3 + 16) = v33;
          if( v33 >= *(_QWORD *)(v3 + 24) )
            return 4;
          v35 = 32 * v33 + *(_QWORD *)(v3 + 8);
          MiIdentifyPfnWrapper(v13, (_MMPFN_IDENTITY *)(v35 - 32));
          *(_QWORD *)(v35 - 8) = v6;
        }
      }
    }
  }
  return 0;
}

Referenced by: