MiDeleteClusterPage

INT64 __fastcall MiDeleteClusterPage(UINT64 P2, UINT8 *a2){
  UINT64 v2; 
  __int64 v3; 
  unsigned __int64 v5; 
  INT64 v6; 
  unsigned __int64 i; 
  INT64 v8; 
  UNICODE_STRING *v9; 
  unsigned __int64 v10; 
  UNICODE_STRING *v11; 
  int v12; 
  __int64 v13; 
  __int64 v14; 
  unsigned __int64 v15; 
  __int64 v16; 
  char *v17; 
  INT64 v18; 
  unsigned __int64 v19; 
  INT64 v20; 
  bool v21; 
  unsigned __int64 v22; 
  ULONG_PTR v23; 
  unsigned int v24; 
  volatile signed __int64 *j; 
  unsigned int v27; 
  char *v28; 
  unsigned __int64 *v29; 
  UINT64 v30; 
  unsigned int v31; 
  INT64 v32; 
  char v33; 
  INT64 v34; 
  char v35; 
  unsigned __int64 v36; 
  char *v37; 
  ULONG_PTR v38; 
  ULONG_PTR BugCheckParameter4; 
  INT64 v40; 
  INT64 v41; 
  unsigned __int64 v42; 
  INT64 v43; 
  UINT64 v44; 
  INT64 a1; 
  INT64 v46; 
  UINT64 v47; 
  __int64 v48; 
  INT64 v49[2]; 
  __int64 v50; 
  __int128 v51; 
  v2 = P2;
  v50 = 0i64;
  v3 = -1i64;
  v41 = -1i64;
  *(_OWORD *)v49 = 0i64;
  v5 = -1i64;
  v48 = *((_QWORD *)KeGetCurrentThread() + 23);
  a1 = *(_QWORD *)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(v48 + 1838));
  v44 = *(_QWORD *)((char *)MmGetPteBase() + ((P2 >> 9) & 0x7FFFFFFFF8i64));
  v6 = P2;
  v47 = (v44 >> 12) & 0xFFFFFFFFFi64;
  for( i = 0i64; i < 0x10; ++i )
  {
    v8 = MI_READ_PTE_LOCK_FREE(v6);
    if( !v8 )
      return 0i64;
    if( (v8 & 0x400) == 0 )
      return 0i64;
    v42 = v8 & 0xFFFFFFFFFFFFFBFEui64 | 1;
    v10 = (v42 >> 12) & 0xFFFFFFFFFi64;
    if( i )
    {
      if( v10 != v5 )
        return 0i64;
    }
    v11 = (UNICODE_STRING *)((char *)MmGetPfnDb() + 48 * v10);
    if( byte_140C51D9E )
    {
      v9 = (UNICODE_STRING *)((unsigned __int64)((__int64)(48 * v10) / 48) >> 9);
      if( _bittest64((const signed __int64 *)qword_140C522C8, (unsigned __int64)v9) )
        return 0i64;
    }
    LOBYTE(v12) = MI_PFN_IS_PROTO(v11, v9, v42 >> 12, &v11->Length);
    if( v12 || *(_QWORD *)(qword_140C4E388 + 8 * ((*(_QWORD *)(v14 + 40) >> 39) & 0x3FFi64)) != a1 )
      return 0i64;
    v5 = v13 + 1;
    v6 += 8i64;
  }
  MiDeleteBatch(a2);
  v46 = v5 - 16;
  v15 = v5 - 16;
  v16 = 48 * (v5 - 16);
  v17 = (char *)MmGetPfnDb() + v16;
  v18 = (INT64)v17;
  v19 = (__int64)((unsigned __int128)(v16 * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 3;
  MiSearchNumaNodeTable((PVOID)(v19 + (v19 >> 63)));
  v51 = 0i64;
  v21 = v5 - 16 == v5;
  if( v5 - 16 < v5 )
  {
    v22 = v5 - 16;
    v46 = v5 - 16;
    while( 1 )
    {
      if( v15 == v22 )
      {
        MiLockPageAtDpc((INT64)v17);
      }
      else if( !MiTryLockNestedPageAtDpcInline((INT64)v17) )
      {
        goto LABEL_22;
      }
      v23 = *((_QWORD *)v17 + 1);
      v41 = v15;
      if( (v23 | 0x8000000000000000ui64) != v2 )
      {
        v38 = MI_READ_PTE_LOCK_FREE(v2);
        KeBugCheckEx(0x1Au, 0x403ui64, v2, v38, v23);
      }
      v24 = (unsigned __int8)v17[34];
      if( (v24 & 7) != 6 )
        MiBadShareCount((_MMPFN *)v17);
      if( *((_WORD *)v17 + 16) != 1 || (v17[35] & 0x40) != 0 )
        break;
      ++v15;
      v17 += 48;
      v2 += 8i64;
      ++*((_DWORD *)&v51 + ((unsigned __int64)v24 >> 6));
      if( v15 >= v5 )
      {
LABEL_22:
        v3 = v41;
        goto LABEL_24;
      }
      v22 = v5 - 16;
    }
    v3 = v15;
LABEL_24:
    v21 = v15 == v5;
  }
  if( !v21 )
  {
    if( v3 != -1 )
    {
      for( j = (volatile signed __int64 *)((char *)MmGetPfnDb() + 48 * v3); j != (volatile signed __int64 *)v18; j -= 6 )
        _InterlockedAnd64(j + 3, 0x7FFFFFFFFFFFFFFFui64);
      _InterlockedAnd64(j + 3, 0x7FFFFFFFFFFFFFFFui64);
    }
    return 0i64;
  }
  v27 = 0;
  v28 = v17;
  v29 = (unsigned __int64 *)(v2 - 128);
  v30 = (UINT64)(v17 - 768);
  v31 = 1;
  if( (_DWORD)v51 )
  {
    v27 = v51;
    v31 = 0;
  }
  if( v27 < DWORD1(v51) )
  {
    v27 = DWORD1(v51);
    v31 = 1;
  }
  if( v27 < DWORD2(v51) )
  {
    v27 = DWORD2(v51);
    v31 = 2;
  }
  v32 = a1;
  if( v27 < HIDWORD(v51) )
    v31 = 3;
  do
  {
    v33 = (*(_QWORD *)(v30 + 40) >> 60) & 7;
    *(_WORD *)(v30 + 32) = 2;
    if( v33 == 3 )
      MiClearPfnImageVerified(v30, 12);
    v43 = *(_QWORD *)(v30 + 16);
    if( (v43 & 0x400) == 0 )
    {
      v34 = (v43 & 4) != 0 || (v43 & 2) != 0 ? MI_READ_PTE_LOCK_FREE((INT64)&v43) : 0i64;
      v43 = v34;
      if( v34 )
        MiReleasePageFileInfo(v32, v34, 0, v20, BugCheckParameter4, v40, v41, v42, v43, v44, a1, v46);
    }
    *(_QWORD *)(v30 + 16) = ZeroPte;
    if( *(unsigned __int8 *)(v30 + 34) >> 6 != v31 )
      MiChangePageAttribute(v30, v31, 1);
    v35 = *(_BYTE *)(v30 + 35);
    if( (v35 & 0x10) != 0 )
      *(_BYTE *)(v30 + 35) = v35 & 0xEF;
    MiConvertLockedSmallPageToLarge(v30, v18, 2, 0i64);
    if( v30 != v18 )
      _InterlockedAnd64((volatile signed __int64 *)(v30 + 24), 0x7FFFFFFFFFFFFFFFui64);
    v36 = ZeroPte;
    if( v29 >= (unsigned __int64 *)MmGetPml4eBase()
      && v29 <= (unsigned __int64 *)MmGetPxeUserLimit()
      && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
      && (ZeroPte & 1) != 0 )
    {
      v36 = ZeroPte | 0x8000000000000000ui64;
    }
    *v29 = v36;
    v30 += 48i64;
    ++v29;
  }
  while( v30 < (unsigned __int64)v28 );
  v49[0] = v46;
  v49[1] = 1i64;
  LOBYTE(v50) = 2;
  MiInsertLargePageInNodeList((INT64)v49);
  v37 = (char *)MmGetPfnDb() + 48 * v47;
  MiLockPageAtDpc((INT64)v37);
  *((_QWORD *)v37 + 3) ^= (*((_QWORD *)v37 + 3) ^ (*((_QWORD *)v37 + 3) - 16i64)) & 0x3FFFFFFFFFFFFFFFi64;
  _InterlockedAnd64((volatile signed __int64 *)v37 + 3, 0x7FFFFFFFFFFFFFFFui64);
  _InterlockedExchangeAdd64((volatile signed __int64 *)(v48 + 1272), 0xFFFFFFFFFFFFFFF0ui64);
  return 1i64;
}

Referenced by: