MiMapPagesToZero

NTSTATUS __stdcall MiMapPagesToZero(_MI_LIST_THREAD_CONTEXT *ThreadContext, _MMPFN *Pfn1, UINT64 a3){
  unsigned int v3; 
  _MI_LIST_THREAD_CONTEXT *v4; 
  __int64 v6; 
  unsigned __int64 v7; 
  _MMPTE *PteBase; 
  UINT64 v9; 
  __int64 v10; 
  signed __int64 v11; 
  unsigned __int8 CurrentIrql; 
  int v13; 
  __int64 v15; 
  unsigned __int64 v16; 
  int v17; 
  char v18; 
  unsigned int v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  _MMPTE *PteLimit; 
  unsigned __int64 v23; 
  NTSTATUS v24; 
  unsigned __int64 v25; 
  unsigned __int64 v26; 
  int v27; 
  unsigned int v28; 
  __int64 v29; 
  __int64 v30; 
  unsigned __int64 v31; 
  int v32; 
  UINT64 v33; 
  _MMPTE *Pml4eBase; 
  _MMPTE *PxeUserLimit; 
  unsigned __int64 v36; 
  unsigned __int64 v37; 
  __int64 v39; 
  unsigned int v40; 
  unsigned __int8 v41; 

  v40 = a3;
  v3 = a3;
  v4 = ThreadContext;
  if( (unsigned int)a3 >= 3 )
  {
    v6 = 1i64;
  }
  else
  {
    _mm_lfence();
    v6 = MiLargePageSizes[(unsigned int)a3];
  }
  v39 = v6;
  MiGetUltraMapping(&ThreadContext[8 * (unsigned int)a3 + 22], (unsigned int)a3);
  v37 = v7;
  PteBase = MmGetPteBase();
  v9 = (UINT64)PteBase + ((v7 >> 9) & 0x7FFFFFFFF8i64);
  if( v3 <= 1 )
  {
    v10 = 2 - v3;
    do
    {
      v9 = (UINT64)PteBase + ((v9 >> 9) & 0x7FFFFFFFF8i64);
      --v10;
    }
    while( v10 );
  }
  v11 = Pfn1 - MmGetPfnDb();
  CurrentIrql = KeGetCurrentIrql();
  v41 = CurrentIrql;
  __writecr8(2ui64);
  v13 = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)&Pfn1->u2, 0x3Fui64) )
  {
    do
    {
      ++v13;
      _mm_pause();
    }
    while( Pfn1->u2._bf_0 < 0 );
  }
  if( *((_BYTE *)v4 + 69) == 1 )
  {
    MiRemoveFaultNode(v4);
    _InterlockedAnd64(&Pfn1->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(CurrentIrql);
    ++dword_140C2A070;
    return 0;
  }
  v15 = *((unsigned __int8 *)&Pfn1->u3 + 2) >> 6;
  if( v39 != 1 )
    goto LABEL_19;
  if( (_DWORD)v15 && (_DWORD)v15 != 2 )
  {
    if( (*(_BYTE *)(&Pfn1->u3 + 1) & 0xC0) == 0xC0 )
      MiFinalizePageAttribute(Pfn1, MiCached, 1ui64);
    goto LABEL_19;
  }
  v16 = 0x140000000ui64;
  if( *((_DWORD *)&stru_140C4DB30 + 4 * v15 + 107) == 1 )
  {
    MiChangePageAttribute(Pfn1, MiCached, 1ui64);
LABEL_19:
    v16 = 0x140000000ui64;
  }
  v17 = 4;
  v18 = *((_BYTE *)&Pfn1->u3 + 2) >> 6;
  if( v18 )
  {
    if( v18 == 2 )
      v17 = 28;
  }
  else
  {
    v17 = 12;
  }
  v19 = v17 | 0xA0000000;
  if( v3 <= 1 )
    v19 = v17 | 0xA4000000;
  v20 = (unsigned __int64)MmGetPteBase();
  v21 = ((v11 & 0xFFFFFFFFFi64) << 12) | MmProtectToPteMask[v19 & 0x1F] & 0xFFFF000000000E7Fui64 | 0x21;
  if( v9 < v20 )
    goto LABEL_49;
  PteLimit = MmGetPteLimit();
  if( v9 > (unsigned __int64)PteLimit )
    goto LABEL_49;
  v23 = (__int64)((v9 << 25) - (v20 << 25)) >> 16;
  if( v9 >= (unsigned __int64)MmGetPdeBase() && v9 <= (unsigned __int64)MmGetPdeLimit() )
  {
    if( (_MMPTE *)v9 == MmGetPxeSelfRef() )
    {
      v21 |= 0x8000000000000000ui64;
    }
    else if( (v19 & 0x4000000) == 0 )
    {
      v21 &= ~0x8000000000000000ui64;
    }
    v24 = MiUserPdeOrAbove(v9);
    PteLimit = MmGetPteLimit();
    v16 = 0x140000000ui64;
    v20 = (unsigned __int64)MmGetPteBase();
    if( v24 )
      v21 |= 4ui64;
  }
  v25 = v21;
  v21 |= 4ui64;
  if( v9 > v20 + 0x3FFFFFFF78i64 )
    v21 = v25;
  if( (v19 & 0x4000000) != 0 )
  {
    LODWORD(v26) = MiGetLeafVa(v23);
    v23 = v26;
    v20 = (unsigned __int64)MmGetPteBase();
  }
  if( v23 >= 0xFFFF800000000000ui64 )
  {
    if( *(_BYTE *)(((v23 >> 39) & 0x1FF) - 256 + v16 + 12908296) == 1
      || v23 >= v20 && v23 <= (unsigned __int64)PteLimit )
    {
      goto LABEL_50;
    }
    if( v23 < *(&stru_140C4DB30 + 937) || (v27 = *(&stru_140C4DB30 + 537), v23 > *(&stru_140C4DB30 + 175)) )
      v27 = *(&stru_140C4DB30 + 536);
  }
  else
  {
    v27 = *(&stru_140C4DB30 + 537);
  }
  if( v27 )
LABEL_49:
    v21 |= 0x100ui64;
LABEL_50:
  v28 = v40;
  v29 = v21 ^ ((unsigned __int16)v21 ^ (unsigned __int16)(*(&stru_140C4DB30 + 536) << 8)) & 0x100 | 0x42;
  v30 = v21 ^ ((unsigned __int16)v21 ^ (unsigned __int16)(*(&stru_140C4DB30 + 536) << 8)) & 0x100 | 0xC2;
  if( (v19 & 0x4000000) == 0 )
    v30 = v29;
  v31 = v30 & 0xF0FFFFFFFFFFFFFFui64 | 0xA00000000000000i64;
  if( v40 > 1 )
  {
    v33 = 8 * v39 + v9;
    if( v9 < v33 )
    {
      Pml4eBase = MmGetPml4eBase();
      PxeUserLimit = MmGetPxeUserLimit();
      do
      {
        v36 = v31;
        if( v9 >= (unsigned __int64)Pml4eBase
          && v9 <= (unsigned __int64)PxeUserLimit
          && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
          && (v31 & 1) != 0 )
        {
          v36 = v31 | 0x8000000000000000ui64;
        }
        *(_QWORD *)v9 = v36;
        v9 += 8i64;
        v31 ^= (v31 ^ (v31 + 4096)) & 0xFFFFFFFFF000i64;
      }
      while( v9 < v33 );
      CurrentIrql = v41;
      v4 = ThreadContext;
      v28 = v40;
    }
    v9 -= 8 * v39;
  }
  else
  {
    LOBYTE(v32) = MiPteInShadowRange(v9);
    if( v32 )
    {
      if( (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
        v31 |= 0x8000000000000000ui64;
    }
    *(_QWORD *)v9 = v31;
  }
  *((_QWORD *)v4 + 4) = v9;
  *((_QWORD *)v4 + 5) = v37;
  *((_QWORD *)v4 + 6) = v37 + (v39 << 12) - 1;
  v4[16] = v28;
  *((_QWORD *)v4 + 9) = Pfn1;
  _InterlockedAnd64(&Pfn1->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(CurrentIrql);
  return 1;
}

Referenced by: