MiTrimThisWsle
__int64 __fastcall MiTrimThisWsle(__int64 a1, unsigned __int64 a2, __int64 a3, wchar_t *a4, char a5, _DWORD *a6){
_MMPTE *PteBase;
_QWORD *v11;
int v12;
unsigned __int64 v13;
_UNICODE_STRING *v14;
unsigned int v15;
char v16;
unsigned int v17;
char v18;
int v19;
int v21;
__int64 v22;
__int64 v23;
PteBase = MmGetPteBase();
v11 = (unsigned __int64 *)((char *)&PteBase->u.Long + ((a2 >> 9) & 0x7FFFFFFFF8i64));
if( a6 )
*a6 = 0;
v12 = *(_DWORD *)a4;
if( a2 < (unsigned __int64)PteBase || a2 > (unsigned __int64)MmGetPteLimit() )
{
v14 = (_UNICODE_STRING *)(HIBYTE(*v11) & 0xFi64);
v15 = HIBYTE(*v11) & 0xF;
}
else
{
LODWORD(v13) = MI_READ_PTE_LOCK_FREE((INT64)PteBase + ((a2 >> 9) & 0x7FFFFFFFF8i64));
v15 = (LODWORD(MmGetPfnDb()[(v13 >> 12) & 0xFFFFFFFFFi64].ListEntry.Flink) >> 1) & 7;
}
v16 = a5;
if( (v12 & 0x60) != 0 )
{
LOBYTE(v19) = MI_PFN_IS_PROTO((_UNICODE_STRING *)a3, v14, v15, a4);
if( !v19
|| ((v12 & 0x20) == 0
|| (*(_DWORD *)(a3 + 16) & 0x400i64) != 0
|| ((*(_QWORD *)(a3 + 40) & 0x1000000000i64) != 0 || *(__int64 *)(a3 + 8) <= 0)
&& !MiLocateCloneAddress((_EPROCESS *)(a1 - 1664), (VOID *)(*(_QWORD *)(a3 + 8) | 0x8000000000000000ui64)))
&& ((v12 & 0x40) == 0 || (*(_DWORD *)(a3 + 16) & 0x400i64) == 0) )
{
goto LABEL_26;
}
return 1i64;
}
v17 = v12 & 0xF;
if( !v17 )
return 1i64;
v18 = *(_BYTE *)(a3 + 35);
if( (v18 & 8) == 0 && (v18 & 7u) < 5 )
return 1i64;
if( v15 < v17 )
goto LABEL_26;
if( (a5 & 1) == 0 )
return 1i64;
if( *((_QWORD *)a4 + 30) && a2 <= 0x7FFFFFFEFFFFi64 && a6 )
{
*a6 = 1;
return 0i64;
}
LABEL_26:
v21 = 2;
if( (v16 & 1) == 0 || a2 <= 0x7FFFFFFEFFFFi64 && (*(_BYTE *)(a1 + 184) & 7) == 0 && *(_QWORD *)(a1 + 624) && a6 )
{
if( (*(_BYTE *)(a1 + 184) & 7) != 0 && *(_WORD *)(a3 + 32) != 1
|| v15 >= 6
|| (unsigned int)MiGetPfnPriority((_MMPFN *)a3) >= 5 )
{
return 0i64;
}
v22 = 1i64;
}
else
{
v22 = 2i64;
if( v15 && v15 < 7 )
{
v21 = 0;
v22 = 0i64;
}
if( v21 == 2 )
return 0i64;
}
v23 = 10 * v22;
if( !LOBYTE(a4[4 * v23 + 160]) )
{
LOBYTE(a4[4 * v23 + 160]) = 1;
*(_QWORD *)&a4[4 * v23 + 156] = a2;
}
_bittestandset((signed __int32 *)&a4[4 * v23 + 124], ((unsigned int)v11 >> 3) & 0x1FF);
return 0i64;
}Referenced by:
MiTrimPte
MiTrimPteWorker