MiAppendWsleCluster
INT64 __fastcall MiAppendWsleCluster(INT64 a1, INT64 a2, UINT64 *a3){
_MMPTE *PteBase;
_QWORD *v7;
char v8;
int v9;
bool v10;
__int64 v11;
BOOL v12;
__int64 v13;
unsigned int v15;
UINT64 v16;
PteBase = MmGetPteBase();
v7 = (_QWORD *)((char *)PteBase
+ ((((__int64)(((_QWORD)a3 << 25) - ((_QWORD)PteBase << 25)) >> 16) & 0xFFFFFFFFF000ui64) >> 9));
v8 = HIBYTE(*v7) & 0xF | (16 * ((*v7 >> 60) & 7));
v16 = *a3;
LOBYTE(v9) = MI_PFN_IS_PROTO(
(UNICODE_STRING *)MmGetPfnDb() + 3 * ((v16 >> 12) & 0xFFFFFFFFFi64),
(UNICODE_STRING *)((v16 >> 12) & 0xFFFFFFFFFi64),
(UINT8)v7,
(PWCHAR)MmGetPxeUserLimit());
v10 = v9 == 0;
v11 = *(_QWORD *)(a1 + 8);
v12 = v10;
if( !v11 )
{
LABEL_9:
v15 = *(_DWORD *)(a1 + 24) & 0xFFFFFFFE;
*(_QWORD *)a1 = a2;
*(_QWORD *)(a1 + 8) = a3;
*(_DWORD *)(a1 + 24) = v12 | v15;
*(_QWORD *)(a1 + 16) = 1i64;
*(_BYTE *)(a1 + 28) = v8;
return 1i64;
}
v13 = *(_QWORD *)(a1 + 16);
if( a3 != (UINT64 *)(v11 + 8 * v13) || v8 != *(_BYTE *)(a1 + 28) || v10 != (*(_DWORD *)(a1 + 24) & 1) )
{
if( (*(_DWORD *)(a1 + 24) & 2) != 0 )
return 0i64;
MiTerminateWsleCluster(a1);
goto LABEL_9;
}
*(_QWORD *)(a1 + 16) = v13 + 1;
return 1i64;
}Referenced by:
MiDecommitPages
MiDeleteSystemPagableVm
MiRemoveMappedPtes