MiProcessVmAccessedInfo

char __fastcall MiProcessVmAccessedInfo(
        __int64 a1,
        _DWORD *a2,
        __int64 (__fastcall *a3)(__int64, _QWORD *, char *, unsigned __int64, __int64),
        __int64 a4){
  __int64 v4; 
  _QWORD *v5; 
  _DWORD *v10; 
  unsigned __int64 v11; 
  char *v12; 
  INT64 v13; 
  char *v14; 

  v4 = (unsigned int)*a2;
  v5 = a2 + 2;
  v10 = &a2[2 * v4 + 2];
  while( v5 < (_QWORD *)v10 )
  {
    v11 = *v5 & 0xFFFFFFFFFFFFF000ui64;
    v12 = (char *)MmGetPteBase() + ((v11 >> 9) & 0x7FFFFFFFF8i64);
    LOBYTE(v4) = MI_READ_PTE_LOCK_FREE((INT64)v12);
    if( (v4 & 1) != 0 )
    {
      LOBYTE(v4) = MiGetWsleContents(v13, v11);
      v14 = 0i64;
      LOBYTE(v4) = (v4 & 0xF) - 8;
      if( (unsigned __int8)v4 > 2u )
        v14 = v12;
      if( v14 )
      {
        LODWORD(v4) = a3(a1, v5, v14, v11, a4);
        if( (_DWORD)v4 )
          break;
      }
    }
    ++v5;
  }
  *a2 = 0;
  return v4;
}

Referenced by: