MiScrubLargeMappedPage

NTSTATUS __stdcall MiScrubLargeMappedPage(
        _MMVAD *Vad,
        _MISCRUB_PACKET *ScrubPacket,
        _EPROCESS *Process,
        _KEVENT *StopEvent){
  NTSTATUS v6; 
  unsigned __int64 v7; 
  _MMPTE *PdeBase; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  _MMSUPPORT_INSTANCE *v11; 
  UINT64 v12; 
  char v13; 
  _MMPTE *PteBase; 
  __int64 v15; 
  char *v16; 
  UINT64 v17; 
  UINT64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  __int64 v21; 
  unsigned int v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  _MMPTE *v25; 
  __int64 v26; 
  _MMPFN *PfnDb; 
  unsigned __int64 v28; 
  _MMPFN *v29; 
  UINT64 v30; 
  VOID *v31; 
  UINT8 v32; 
  int v33; 
  int v34; 
  UINT64 v35; 
  unsigned __int64 v36; 
  int v37; 
  UINT64 v39; 
  char WsIrql; 
  char WsIrql_1; 
  INT64 v42; 
  unsigned __int64 v43; 
  UINT64 v44; 
  int v45; 
  int v46; 
  UINT64 v47; 
  unsigned __int64 v48; 
  _MMPFN *v49; 
  unsigned __int64 v50; 
  VOID *OpaqueParameter; 
  _MMSUPPORT_INSTANCE *v52; 
  _MMVAD *v53; 
  _MI_TB_FLUSH_LIST TbFlushList[48]; 

  OpaqueParameter = Vad;
  v53 = Vad;
  memset(TbFlushList, 0i64, 0xB8u);
  v6 = 1;
  TbFlushList[0] = 1;
  LOWORD(TbFlushList[1]) = 0;
  *(_QWORD *)&TbFlushList[4] = 0i64;
  TbFlushList[2] = 20;
  *(_QWORD *)&TbFlushList[6] = 0i64;
  WsIrql_1 = 0;
  v43 = 0i64;
  v7 = ((HIDWORD(Process->Pcb.ProfileListHead.Flink) | ((unsigned __int64)BYTE1(Process->Pcb.ProfileListHead.Blink) << 32)) << 12) | 0xFFF;
  PdeBase = MmGetPdeBase();
  v9 = (unsigned __int64)PdeBase
     + ((((unsigned __int64)LODWORD(Process->Pcb.ProfileListHead.Flink) >> 6) | ((unsigned __int64)LOBYTE(Process->Pcb.ProfileListHead.Blink) << 26)) & 0x3FFFFFF8);
  v48 = v9;
  v10 = (unsigned __int64)PdeBase + ((v7 >> 18) & 0x3FFFFFF8);
  v50 = v10;
  v11 = (_MMSUPPORT_INSTANCE *)(ScrubPacket + 416);
  v52 = v11;
  MiLockWorkingSetShared();
  WsIrql = v13;
LABEL_2:
  PteBase = MmGetPteBase();
  while( v9 <= v10 )
  {
    v42 = v9;
    v49 = (_MMPFN *)((_QWORD)PteBase << 25);
    v15 = (((__int64)((v9 << 25) - ((_QWORD)PteBase << 25)) >> 16 << 25) - ((_QWORD)PteBase << 25)) >> 16;
    v47 = (UINT64)MiLockLowestValidPageTable((INT64)v11, (INT64 *)v9, (INT64 **)&v42);
    v16 = (char *)v10;
    if( v42 != v9 )
      v16 = (char *)PteBase + ((v10 >> 9) & 0x7FFFFFFFF8i64);
    do
    {
      LODWORD(v17) = MI_READ_PTE_LOCK_FREE(v42);
      v18 = v17;
      v44 = v17;
      if( v17 )
        break;
      v43 = 0i64;
      v19 = v42 + 8;
      v42 = v19;
      if( (v19 & 0xFFF) == 0 )
        break;
    }
    while( v19 <= (unsigned __int64)v16 );
    if( !v17 )
    {
      MiUnlockPageTableInternal((INT64)v11, v47);
      LODWORD(v20) = MiGetLeafVa(v42);
      v9 = (unsigned __int64)MmGetPdeBase() + ((v20 >> 18) & 0x3FFFFFF8);
      v48 = v9;
      v6 = 1;
      goto LABEL_2;
    }
    if( (v17 & 1) != 0 && (v17 & 0x80u) != 0i64 )
    {
      MiPteInShadowRange((UINT64)&v44);
      v21 = (v18 >> 12) & 0xFFFFFFFFFi64;
      v22 = 1;
      v23 = 512i64;
      v24 = ((((v42 << 25) - (__int64)v49) >> 16 << 25) - (__int64)v49) >> 16;
      v25 = MmGetPteBase();
      while( v24 >= (unsigned __int64)v25 && v24 <= (unsigned __int64)MmGetPteLimit() )
      {
        v24 = (__int64)((v24 << 25) - (_QWORD)v49) >> 16;
        v23 <<= 9;
        ++v22;
      }
      MiRewritePteWithLockBit((INT64)v11, (INT64 *)v42, ZeroPte.u.Hard._bf_0);
      v44 &= 0xCFFFFFFFFFFFFFFFui64;
      MiInsertTbFlushEntry(TbFlushList, (VOID *)v15, 1ui64, v22);
      MiFlushTbList(TbFlushList);
      v26 = v43 & -(__int64)(v43 < v23);
      v43 = v26;
      v46 = 0;
      PfnDb = MmGetPfnDb();
      v28 = (unsigned __int64)&PfnDb[v21 + v23];
      v49 = (_MMPFN *)v28;
      v29 = &PfnDb[v26 + v21];
      v30 = v47;
      while( (unsigned __int64)v29 < v28 )
      {
        v43 = ++v26;
        if( v29->u3.ReferenceCount == 2 )
        {
          v31 = OpaqueParameter;
          if( MiScrubPage(OpaqueParameter, v29, 0i64, (VOID *)1) < 0 )
            MiMakePageBad(v29, 1ui64, v32);
          LOBYTE(v33) = MiWorkingSetIsContended((INT64)v11);
          if( v33
            || (unsigned int)MiPageTableLockIsContended((__int64)v11, v30)
            || (unsigned int)KeShouldYieldProcessor() )
          {
            v46 = 1;
            break;
          }
          LOBYTE(v34) = MiScrubInterrupted((INT64)v31);
          if( v34 )
          {
            WsIrql_1 = 1;
            break;
          }
          v28 = (unsigned __int64)v49;
          v26 = v43;
        }
        ++v29;
      }
      v35 = v44 | 0x20;
      v44 = v35;
      v45 = 0;
      v36 = v35;
      LOBYTE(v37) = MiPteInShadowRange(v42);
      if( v37 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v35 & 1) != 0 )
        v36 = v35 | 0x8000000000000000ui64;
      *(_QWORD *)v42 = v36;
      if( v45 )
        MiWritePteShadow();
      MiUnlockPageTableInternal((INT64)v11, v47);
      if( v29 == v49 )
      {
        v9 += 8 * (v23 >> 9);
        v48 = v9;
        v43 = 0i64;
      }
      if( WsIrql_1 == 1 )
      {
        v6 = 0;
        break;
      }
      v10 = v50;
      v6 = 1;
      PteBase = MmGetPteBase();
      if( v46 )
      {
        LOBYTE(v12) = WsIrql;
        MiUnlockWorkingSetShared(v11, v12);
        MiLockWorkingSetShared();
        goto LABEL_2;
      }
    }
    else
    {
      MiUnlockPageTableInternal((INT64)v11, v47);
      LOBYTE(v39) = WsIrql;
      MiUnlockWorkingSetShared(v11, v39);
      v6 = 1;
      PteBase = MmGetPteBase();
      MiLockWorkingSetShared();
    }
  }
  LOBYTE(v12) = WsIrql;
  MiUnlockWorkingSetShared(v11, v12);
  return v6;
}

Referenced by: