MiCaptureDeleteHierarchy

INT64 __fastcall MiCaptureDeleteHierarchy(
        _KPRCB *Prcb,
        UINT64 Reset,
        INT64 Remote,
        INT64 SnapPmc,
        _PROC_PERF_CHECK_SNAP *Snap){
  UINT8 v5; 
  INT64 result; 
  _MMPTE *PteBase; 
  _BYTE *v9; 
  __int64 v10; 
  __int64 *v11; 
  unsigned int v12; 
  __int64 v13; 
  __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  v5 = Remote;
  *(_DWORD *)SnapPmc = 0;
  result = (INT64)MmGetPdeBase();
  PteBase = MmGetPteBase();
  v9 = (_BYTE *)SnapPmc;
  v10 = 2i64;
  do
  {
    v16 = result + (((unsigned __int64)Prcb >> 18) & 0x3FFFFFF8);
    v15 = (unsigned __int64)PteBase + ((v16 >> 9) & 0x7FFFFFFFF8i64);
    v11 = &v14;
    v14 = (__int64)PteBase + ((v15 >> 9) & 0x7FFFFFFFF8i64);
    v12 = 0;
    while( 1 )
    {
      v13 = *(_QWORD *)*v11;
      if( !v13 )
        break;
      if( (v13 & 1) == 0 && v12 != 2 )
      {
        MiMakeSystemAddressValid(((*v11 << 25) - ((_QWORD)PteBase << 25)) >> 16, 0i64, 0i64, v5, 1);
        PteBase = MmGetPteBase();
      }
      ++v12;
      ++v11;
      if( v12 >= 3 )
        goto LABEL_6;
    }
    *v9 = 1 << (2 - v12);
LABEL_6:
    ++v9;
    result = (INT64)MmGetPdeBase();
    Prcb = (_KPRCB *)Reset;
    --v10;
  }
  while( v10 );
  return result;
}

Referenced by: