MiDeleteSystemPagableVm

VOID __stdcall MiDeleteSystemPagableVm(
        _MMSUPPORT_INSTANCE *Ws,
        _CONTROL_AREA *ControlArea,
        _MMPTE *PointerPte,
        UINT64 NumberOfPtes,
        UINT64 Flags,
        _MI_DELETE_VA_INFO *DeleteInfo){
  _MMPTE *v6; 
  int v7; 
  int v10; 
  int v11; 
  _MMPTE *v12; 
  __int64 v13; 
  _MI_TB_FLUSH_LIST v14; 
  _MI_PARTITION *v15; 
  unsigned __int8 v16; 
  unsigned __int8 v17; 
  __int64 v18; 
  INT64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  _MMPFN *v23; 
  unsigned __int64 *v24; 
  unsigned __int64 v25; 
  INT64 v26; 
  _MMPTE *v27; 
  char v28; 
  char v29; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v30; 
  int v31; 
  INT64 v32; 
  _UNICODE_STRING *v33; 
  UINT8 v34; 
  wchar_t *v35; 
  __int64 v36; 
  int v37; 
  __int64 bf_0; 
  _MI_PARTITION *v39; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v40; 
  int v41; 
  _MMPFN *v42; 
  int v43; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v44; 
  int v45; 
  int v46; 
  __int64 v47; 
  __int64 v48; 
  unsigned __int8 v49; 
  INT64 v50; 
  UINT64 v51; 
  int v52; 
  int v53; 
  int v54; 
  int v55; 
  INT64 v56; 
  UINT64 SpinCount; 
  _MMPTE *PointerPtea; 
  _MMPTE *v59; 
  INT64 v60[2]; 
  __int128 v61; 
  INT64 *v62; 
  __int64 v63; 
  _CONTROL_AREA *ControlAreaa; 
  _MI_TB_FLUSH_LIST TbFlushList; 
  __int16 v66; 
  __int16 v67; 
  __int64 v68; 
  __int64 v69; 
  __int64 v70; 
  __int128 v71; 
  __int128 v72; 
  __int128 v73; 
  __int128 v74; 
  __int128 v75; 
  __int128 v76; 
  __int128 v77; 
  __int128 v78; 
  __int128 v79; 
  __int64 v80; 

  PointerPtea = (_MMPTE *)Ws;
  v6 = (_MMPTE *)Ws;
  ControlAreaa = ControlArea;
  v7 = 0;
  v62 = 0i64;
  v67 = 0;
  v80 = 0i64;
  v54 = 0;
  *(_OWORD *)v60 = 0i64;
  v61 = 0i64;
  v71 = 0i64;
  v72 = 0i64;
  v73 = 0i64;
  v74 = 0i64;
  v75 = 0i64;
  v76 = 0i64;
  v77 = 0i64;
  v78 = 0i64;
  v79 = 0i64;
  if( ControlArea )
  {
    if( (ControlArea->u.LongFlags & 0x800) != 0 )
      v7 = 1;
    v54 = v7;
  }
  v10 = 10;
  v51 = 0i64;
  v11 = 0;
  HIDWORD(SpinCount) = Flags & 1;
  v12 = 0i64;
  v52 = 0;
  if( (Flags & 1) == 0 )
    v10 = 14;
  DWORD2(v61) = v10;
  v55 = Flags & 4;
  if( (Flags & 4) != 0 )
    DWORD2(v61) = v10 | 0x10;
  v13 = v6[23].u.Long & 7;
  v14 = 0;
  v63 = (_QWORD)MmGetPteBase() << 25;
  v53 = 0;
  if( (unsigned __int8)(v13 - 3) > 1u )
  {
    if( (Flags & 2) != 0 )
    {
      if( *(&stru_140C4DB30 + 654) )
        v11 = 1;
      v52 = v11;
    }
    v14 = 2;
    v53 = 2;
  }
  v15 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * HIWORD(v6[21].u.TimeStamp._bf_0));
  v56 = (INT64)v15;
  v68 = 20i64;
  TbFlushList = v14;
  v66 = 0;
  v69 = 0i64;
  v70 = 0i64;
  v59 = &PointerPte[NumberOfPtes];
  MiLockWorkingSetShared();
  v17 = v16;
  v49 = v16;
  while( PointerPte < v59 )
  {
    if( v12 )
    {
      if( ((unsigned __int16)PointerPte & 0xFFF) != 0 )
        goto LABEL_21;
      MiFlushTbList(&TbFlushList);
      LODWORD(v18) = MiTerminateWsleCluster((INT64)v60);
      *(_QWORD *)&DeleteInfo->ReducedCommitClonePages += v18;
      MiUnlockPageTableInternal((INT64)v6, (UINT64)v12);
    }
    v12 = MiLockLowestValidPageTable((INT64)v6, (INT64 *)PointerPte, &v62);
    v51 = (UINT64)v12;
    if( v12 != (_MMPTE *)((char *)MmGetPteBase() + (((unsigned __int64)PointerPte >> 9) & 0x7FFFFFFFF8i64)) )
    {
      MiUnlockPageTableInternal((INT64)v6, (UINT64)v12);
      v12 = 0i64;
      v51 = 0i64;
      PointerPte = (_MMPTE *)(((unsigned __int64)PointerPte & 0xFFFFFFFFFFFFF000ui64) + 4096);
      continue;
    }
LABEL_21:
    LODWORD(v19) = MI_READ_PTE_LOCK_FREE((INT64)PointerPte);
    v50 = v19;
    v20 = v19;
    if( v19 )
    {
      if( (v19 & 1) == 0 )
      {
        if( (v19 & 0x400) == 0 )
        {
          if( (v19 & 0x800) != 0 )
          {
            v42 = MiLockTransitionLeafPage((ULONG_PTR)PointerPte, 0i64);
            if( !v42 )
              goto LABEL_93;
            if( v55 )
            {
              MiIsPfnSystemCharged((INT64)v42);
              if( v43 )
              {
                MiDriverPageIsDangling((INT64)v42);
                *((_BYTE *)&v42->u3 + 3) &= ~0x20u;
              }
            }
            if( MiDeleteTransitionPte(PointerPte, v42, 0x11u, 1ui64) == PageStillReferenced )
              ++*(_QWORD *)&DeleteInfo->ReducedCommitClonePages;
            ++*(_QWORD *)&DeleteInfo[1].ReducedCommitClonePages;
          }
          else if( (v19 & 0x3E0) != 0 )
          {
            MiReleasePageFileSpace(v15, (_MMPTE)v19, 1ui64);
            v44.Long = ZeroPte.u.Long;
            LOBYTE(v45) = MiPteInShadowRange((UINT64)PointerPte);
            if( v45 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
              v44.Long = ZeroPte.u.Long | 0x8000000000000000ui64;
            PointerPte->u.Long = v44.Long;
            ++*(_QWORD *)&DeleteInfo[1].ReducedCommitClonePages;
          }
          goto LABEL_86;
        }
        if( (v19 & 2) == 0 )
        {
          if( MI_PROTO_FORMAT_COMBINED((_MMPTE)v19) )
          {
            ++*(_QWORD *)&DeleteInfo[1].ReducedCommitClonePages;
            if( *(&stru_140C4DB30 + 42) )
            {
              if( (v20 & 0x10) != 0 )
                v20 &= ~0x10ui64;
              else
                v20 &= ~*(&stru_140C4DB30 + 42);
            }
            v39 = **(_MI_PARTITION ***)((((v20 >> 16) - 48) & 0xFFFFFFFFFFFFF000ui64) + 0x10);
            if( MiDecrementCombinedPte(v6) == PageStillReferenced && v39 == v15 )
              ++*(_QWORD *)&DeleteInfo->ReducedCommitClonePages;
            goto LABEL_66;
          }
          if( v54 != 1 )
          {
            if( *(&stru_140C4DB30 + 42) )
            {
              if( (v20 & 0x10) != 0 )
                v20 &= ~0x10ui64;
              else
                v20 &= ~*(&stru_140C4DB30 + 42);
            }
            if( !MiImageProtoChargedCommit(ControlAreaa, (_MMPTE *)(v20 >> 16)) )
              goto LABEL_66;
          }
        }
        ++*(_QWORD *)&DeleteInfo[1].ReducedCommitClonePages;
LABEL_66:
        v40.Long = ZeroPte.u.Long;
        LOBYTE(v41) = MiPteInShadowRange((UINT64)PointerPte);
        if( v41 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
          v40.Long = ZeroPte.u.Long | 0x8000000000000000ui64;
        PointerPte->u.Long = v40.Long;
        goto LABEL_86;
      }
      v21 = (((_QWORD)PointerPte << 25) - v63) >> 16;
      LODWORD(v22) = MI_READ_PTE_LOCK_FREE((INT64)&v50);
      v23 = &MmGetPfnDb()[(v22 >> 12) & 0xFFFFFFFFFi64];
      v24 = (unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + ((v21 >> 9) & 0x7FFFFFFFF8i64));
      v25 = *v24;
      MiPteInShadowRange((UINT64)v24);
      v28 = HIBYTE(v25) & 0xF | (16 * ((v25 >> 60) & 7));
      v29 = v28 & 0xF;
      if( (v28 & 0xF) == 9 )
      {
        MiWriteWsle(v26, v21, v28 & 0xF0 | 0xA);
        v6 = PointerPtea;
        MiDeleteValidSystemPage(PointerPtea, (UINT64)PointerPte, (_MI_DELETE_VA_INFO *)(v55 | 0x10u));
        if( HIDWORD(SpinCount) )
          goto LABEL_33;
        v50 = 0i64;
        MiInitializeTbFlushStamps((UINT64 *)&v50);
        v30.Long = v50;
        LOBYTE(v31) = MiPteInShadowRange((UINT64)PointerPte);
        if( v31 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v30.Long & 1) != 0 )
          v30.Long |= 0x8000000000000000ui64;
        PointerPte->u.Long = v30.Long;
        v32 = v50;
        if( *(&stru_140C4DB30 + 42) && (v50 & 0x10) == 0 )
          v32 = v50 & ~*(&stru_140C4DB30 + 42);
        if( (v32 & 0xFFFFFFFF00000000ui64) == 0 )
LABEL_33:
          MiInsertTbFlushEntry(&TbFlushList, (VOID *)v21, 1ui64, 0i64);
LABEL_47:
        ++*(_QWORD *)&DeleteInfo->ResidentPages;
        v15 = (_MI_PARTITION *)v56;
        if( v53 == 2 )
          MiReturnSystemCharges(v56, 1ui64, 1i64);
        goto LABEL_86;
      }
      v6 = PointerPtea;
      if( v52 )
        MI_WSLE_LOG_ACCESS((_MMSUPPORT_INSTANCE *)PointerPtea, (_MMWSLE *)PointerPte, v27);
      if( !MiAppendWsleCluster((INT64)v60, (INT64)v6, &PointerPte->u.Long) )
      {
        LODWORD(v36) = MiTerminateWsleCluster((INT64)v60);
        *(_QWORD *)&DeleteInfo->ReducedCommitClonePages += v36;
        MiAppendWsleCluster((INT64)v60, (INT64)v6, &PointerPte->u.Long);
      }
      LOBYTE(v37) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v23, v33, v34, v35);
      if( !v37 )
        goto LABEL_45;
      bf_0 = v23->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0;
      if( (bf_0 & 0x400) == 0 || (v20 & 0x200) != 0 )
        goto LABEL_45;
      if( *(&stru_140C4DB30 + 42) && (bf_0 & 0x10) == 0 )
        bf_0 &= ~*(&stru_140C4DB30 + 42);
      if( (*(_DWORD *)(*(_QWORD *)(bf_0 >> 16) + 56i64) & 0x820) == 2080 )
LABEL_45:
        ++*(_QWORD *)&DeleteInfo[1].ReducedCommitClonePages;
      if( v29 == 8 )
        goto LABEL_47;
      v15 = (_MI_PARTITION *)v56;
    }
LABEL_86:
    if( ++PointerPte == v59 || ((unsigned __int8)PointerPte & 0x78) != 0 )
    {
      v12 = (_MMPTE *)v51;
LABEL_93:
      v17 = v49;
      continue;
    }
    LOBYTE(v46) = MiWorkingSetIsContended((INT64)v6);
    v12 = (_MMPTE *)v51;
    if( !v46 && !(unsigned int)MiPageTableLockIsContended((__int64)v6, v51) && !(unsigned int)KeShouldYieldProcessor() )
      goto LABEL_93;
    MiFlushTbList(&TbFlushList);
    LODWORD(v47) = MiTerminateWsleCluster((INT64)v60);
    *(_QWORD *)&DeleteInfo->ReducedCommitClonePages += v47;
    MiUnlockPageTableInternal((INT64)v6, (UINT64)v12);
    v17 = v49;
    MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)v6, v49);
    v12 = 0i64;
    v51 = 0i64;
    MiLockWorkingSetShared();
  }
  MiFlushTbList(&TbFlushList);
  if( v12 )
  {
    LODWORD(v48) = MiTerminateWsleCluster((INT64)v60);
    *(_QWORD *)&DeleteInfo->ReducedCommitClonePages += v48;
    MiUnlockPageTableInternal((INT64)v6, (UINT64)v12);
  }
  MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)v6, v17);
}

Referenced by:

MiDeleteBootRange
MiFreeInitializationCode
MiMapSystemImageWithLargePage
MmFreePoolMemory
MmReturnChargesToLockPagedPool