MiCountSharedPages

INT64 __fastcall MiCountSharedPages(INT64 a1, UINT64 a2, UINT64 a3){
  INT64 v6; 
  UINT8 v7; 
  UINT64 v8; 
  __int64 v9; 
  __int64 v10; 
  unsigned __int64 v11; 
  UINT64 LeafVa; 
  CHAR *AnyMultiplexedVm; 
  int v14; 
  UINT8 v15; 
  WCHAR *v16; 
  _MMPTE *PteBase; 
  UINT64 v18; 
  UINT64 v19; 
  UINT64 v20; 
  int v21; 
  int v22; 
  _MMPTE *Pml4eBase; 
  unsigned __int64 v24; 
  signed __int64 v25; 
  UNICODE_STRING *PxeUserLimit; 
  int v27; 
  UNICODE_STRING *v28; 
  int v29; 
  int v30; 
  UINT8 v32; 
  INT64 v33; 
  UINT64 v34; 
  __int64 v35; 
  __int128 v36; 
  _SUBSECTION *ContainingSubsection; 
  __int64 v38; 
  __int16 v39; 
  _BYTE v40[14]; 
  __int64 v41; 
  CHAR *v42; 
  unsigned __int64 v43; 
  __int64 v44; 
  INT64(__fastcall *v45)(INT64); 
  __int128 *v46; 
  v6 = 0i64;
  v33 = *((_QWORD *)KeGetCurrentThread() + 23) + 1664i64;
  v7 = MiLockWorkingSetShared(v33);
  v32 = v7;
  if( a2 > a3 )
    goto LABEL_55;
  v8 = a2;
  v9 = (_QWORD)MmGetPteBase() << 25;
  v35 = v9;
  v10 = (__int64)((a3 << 25) - v9) >> 16;
  v38 = v10;
LABEL_3:
  v36 = 0i64;
  memset((INT64)v40, 0i64);
  v39 = 2145;
  v11 = (__int64)((v8 << 25) - v9) >> 16;
  LeafVa = MiGetLeafVa(v11);
  if( LeafVa < 0xFFFF800000000000ui64 || LeafVa >= qword_140C4F878 && LeafVa <= qword_140C4E0A8 )
    AnyMultiplexedVm = (CHAR *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1664i64);
  else
    AnyMultiplexedVm = MiGetAnyMultiplexedVm(1i64);
  v14 = MiFastLockLeafPageTable((INT64)AnyMultiplexedVm, v11);
  if( v14 )
  {
    LODWORD(v36) = v14 - 1;
    PteBase = MmGetPteBase();
    v18 = (UINT64)PteBase + ((v11 >> 9) & 0x7FFFFFFFF8i64);
    *((_QWORD *)&v36 + 1) = v18;
  }
  else
  {
    v39 |= 4u;
    v46 = &v36;
    v41 = 0i64;
    v42 = AnyMultiplexedVm;
    v40[0] = v40[0] & 0xE3 | 4;
    v45 = MiGetNextPageTableTail;
    v40[4] = v32;
    v43 = v11;
    v44 = v10;
    MiWalkPageTables((INT64)&v39);
    v18 = *((_QWORD *)&v36 + 1);
    PteBase = MmGetPteBase();
  }
  if( v18 )
  {
    v20 = (UINT64)PteBase + ((v18 >> 9) & 0x7FFFFFFFF8i64);
    v19 = a3 + 8;
  }
  else
  {
    v19 = a3 + 8;
    v20 = 0i64;
    v18 = a3 + 8;
  }
  v21 = *(_DWORD *)(a1 + 48) >> 7;
  v34 = v20;
  if( (*(_DWORD *)(a1 + 48) & 0x70) != 32 || (v21 & 0x1F) == 1 )
  {
    if( (v21 & 5) != 5 )
      v6 += (__int64)(v18 - a2) >> 3;
    a2 = v18;
  }
  else
  {
    for( ; a2 < v18; a2 += 8i64 )
    {
      MiPteNeedsCommitCharge((_MMVAD *)a1, (_MMPTE *)a2);
      if( v22 == 1 )
        ++v6;
    }
  }
  if( a2 != v19 )
  {
    Pml4eBase = MmGetPml4eBase();
    v24 = (__int64)((a2 << 25) - v35) >> 16;
    while( 1 )
    {
      v25 = *(_QWORD *)a2;
      PxeUserLimit = (UNICODE_STRING *)MmGetPxeUserLimit();
      if( a2 >= (unsigned __int64)Pml4eBase && a2 <= (unsigned __int64)PxeUserLimit )
        PxeUserLimit = (UNICODE_STRING *)MmGetPxeUserLimit();
      if( v25 )
      {
        if( (v25 & 1) != 0 )
        {
          if( (v25 & 0x200) != 0 )
            goto LABEL_48;
          v28 = (UNICODE_STRING *)((char *)MmGetPfnDb() + 48 * (((unsigned __int64)v25 >> 12) & 0xFFFFFFFFFi64));
          LOBYTE(v29) = MI_PFN_IS_PROTO(v28, PxeUserLimit, v15, v16);
          if( !v29
            || (_MMPTE *)((unsigned __int64)v28->Buffer | 0x8000000000000000ui64) != MiGetProtoPteAddress(
                                                                                       (_MMVAD *)a1,
                                                                                       v24 >> 12,
                                                                                       0i64,
                                                                                       &ContainingSubsection) )
          {
            goto LABEL_48;
          }
        }
        else
        {
          if( (v25 & 0x400) == 0 )
            goto LABEL_48;
          if( MiIsPrototypePteVadLookup(v25) )
          {
            if( (v25 & 0xA0) == 0xA0 )
              goto LABEL_48;
          }
          else
          {
            if( qword_140C4DC80 && (v25 & 0x10) == 0 )
              v25 &= ~qword_140C4DC80;
            if( (_MMPTE *)(v25 >> 16) != MiGetProtoPteAddress((_MMVAD *)a1, v24 >> 12, 0i64, &ContainingSubsection) )
              goto LABEL_48;
            if( (*(_DWORD *)(a1 + 48) & 0x70) == 32 )
            {
              MiPteNeedsCommitCharge((_MMVAD *)a1, (_MMPTE *)a2);
              if( v30 != 1 )
                goto LABEL_48;
            }
          }
        }
      }
      else
      {
        MiPteNeedsCommitCharge((_MMVAD *)a1, (_MMPTE *)a2);
        if( v27 != 1 )
          goto LABEL_48;
      }
      ++v6;
LABEL_48:
      a2 += 8i64;
      v24 += 4096i64;
      v8 = a2;
      if( (a2 & 0xFFF) == 0 || a2 > a3 )
      {
        MiUnlockPageTableInternal(v33, v34);
        v9 = v35;
        v10 = v38;
        if( a2 > a3 )
          goto LABEL_54;
        goto LABEL_3;
      }
    }
  }
  if( v20 )
    MiUnlockPageTableInternal(v33, v20);
LABEL_54:
  v7 = v32;
LABEL_55:
  MiUnlockWorkingSetShared(v33, v7);
  return v6;
}

Referenced by: