MiAppendWsleCluster

INT64 __fastcall MiAppendWsleCluster(INT64 a1, INT64 a2, UINT64 *a3){
  _MMPTE *PteBase; 
  _QWORD *v7; 
  char v8; 
  int v9; 
  bool v10; 
  __int64 v11; 
  BOOL v12; 
  __int64 v13; 
  unsigned int v15; 
  UINT64 v16; 
  PteBase = MmGetPteBase();
  v7 = (_QWORD *)((char *)PteBase
                + ((((__int64)(((_QWORD)a3 << 25) - ((_QWORD)PteBase << 25)) >> 16) & 0xFFFFFFFFF000ui64) >> 9));
  v8 = HIBYTE(*v7) & 0xF | (16 * ((*v7 >> 60) & 7));
  v16 = *a3;
  LOBYTE(v9) = MI_PFN_IS_PROTO(
                 (UNICODE_STRING *)MmGetPfnDb() + 3 * ((v16 >> 12) & 0xFFFFFFFFFi64),
                 (UNICODE_STRING *)((v16 >> 12) & 0xFFFFFFFFFi64),
                 (UINT8)v7,
                 (PWCHAR)MmGetPxeUserLimit());
  v10 = v9 == 0;
  v11 = *(_QWORD *)(a1 + 8);
  v12 = v10;
  if( !v11 )
  {
LABEL_9:
    v15 = *(_DWORD *)(a1 + 24) & 0xFFFFFFFE;
    *(_QWORD *)a1 = a2;
    *(_QWORD *)(a1 + 8) = a3;
    *(_DWORD *)(a1 + 24) = v12 | v15;
    *(_QWORD *)(a1 + 16) = 1i64;
    *(_BYTE *)(a1 + 28) = v8;
    return 1i64;
  }
  v13 = *(_QWORD *)(a1 + 16);
  if( a3 != (UINT64 *)(v11 + 8 * v13) || v8 != *(_BYTE *)(a1 + 28) || v10 != (*(_DWORD *)(a1 + 24) & 1) )
  {
    if( (*(_DWORD *)(a1 + 24) & 2) != 0 )
      return 0i64;
    MiTerminateWsleCluster(a1);
    goto LABEL_9;
  }
  *(_QWORD *)(a1 + 16) = v13 + 1;
  return 1i64;
}

Referenced by:

MiDecommitPages
MiDeleteSystemPagableVm
MiRemoveMappedPtes