MiScrubAwePage

NTSTATUS __fastcall MiScrubAwePage(VOID *OpaqueParameter, __int64 a2, _DWORD *a3){
  _MMPFN *v4; 
  UINT64 PteLong; 
  _EPROCESS *Process; 
  _MMPTE *PteBase; 
  _MMSUPPORT_INSTANCE *p_Instance; 
  __int64 v10; 
  char v11; 
  UINT64 v12; 
  __int64 v13; 
  __int64 v14; 
  unsigned __int64 Long; 
  int v16; 
  NTSTATUS v17; 
  __int64 v18; 
  int v19; 
  __int64 v20; 
  UINT64 v21; 
  char WsIrql; 

  v4 = &MmGetPfnDb()[a2];
  PteLong = v4->PteLong;
  if( !PteLong )
    return MiScrubPage(OpaqueParameter, v4, 0i64, (VOID *)1);
  Process = KeGetCurrentThread()->ApcState.Process;
  if( (*a3 & 1) == 0 )
    return 0;
  if( (v4->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
    return MiScrubPage(OpaqueParameter, v4, 0i64, (VOID *)1);
  PteBase = MmGetPteBase();
  p_Instance = &Process->Vm.Instance;
  v10 = (__int64)((PteLong << 25) - ((_QWORD)PteBase << 25)) >> 16;
  MiLockWorkingSetShared();
  WsIrql = v11;
  if( v4->u3.ReferenceCount == 2 )
  {
    v21 = (UINT64)PteBase + ((PteLong >> 9) & 0x7FFFFFFFF8i64);
    MiLockPageTableInternal((INT64)p_Instance, v21, 0i64);
    LODWORD(v13) = MI_READ_PTE_LOCK_FREE(PteLong);
    v14 = v13;
    LODWORD(v13) = v13 & 1;
    v20 = (unsigned int)v13;
    if( (_DWORD)v13 )
    {
      Long = ZeroPte.u.Long;
      LOBYTE(v16) = MiPteInShadowRange(PteLong);
      if( v16 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
        Long = ZeroPte.u.Long | 0x8000000000000000ui64;
      *(_QWORD *)PteLong = Long;
      KeFlushSingleTb(v10, FlushUser, 0i64);
    }
    v17 = MiScrubPage(OpaqueParameter, v4, 0i64, (VOID *)1);
    if( v20 )
    {
      v18 = v14 | 0x20;
      LOBYTE(v19) = MiPteInShadowRange(PteLong);
      if( v19 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v18 & 1) != 0 )
        v18 |= 0x8000000000000000ui64;
      *(_QWORD *)PteLong = v18;
    }
    MiUnlockPageTableInternal((INT64)p_Instance, v21);
    v11 = WsIrql;
  }
  else
  {
    v17 = 0;
  }
  LOBYTE(v12) = v11;
  MiUnlockWorkingSetShared(p_Instance, v12);
  return v17;
}

Referenced by: