RemoveListHeadPte
UINT64 *__fastcall RemoveListHeadPte(UINT64 *a1){
UINT64 v1;
UINT64 *v3;
ULONG_PTR v4;
ULONG_PTR v5;
UINT64 PteLink;
INT64 v7;
__int64 v8;
__int64 v9;
INT64 v10;
__int64 v11;
v1 = a1[2];
v3 = (UINT64 *)(v1 + 8 * MiGetPteLink(*a1));
v4 = MI_READ_PTE_LOCK_FREE((INT64)v3);
if( (v4 & 0x3E0) != 0 || (v4 & 1) != 0 )
KeBugCheckEx(0x1Au, 0x3800ui64, (ULONG_PTR)v3, v4, 0i64);
v5 = MI_READ_PTE_LOCK_FREE((INT64)(v3 + 1));
if( (v5 & 0x3E0) != 0 || (v5 & 1) != 0 )
KeBugCheckEx(0x1Au, 0x3801ui64, (ULONG_PTR)v3, v5, 0i64);
PteLink = MiGetPteLink(*v3);
v7 = MiSwizzleInvalidPte(PteLink << 28);
*a1 = v7;
v8 = (__int64)((__int64)MmGetPteBase() + (((unsigned __int64)a1 >> 9) & 0x7FFFFFFFF8i64) - v1) >> 3;
if( v9 == v8 )
{
a1[1] = v7;
}
else
{
v10 = MiSwizzleInvalidPte(v8 << 28);
*(_QWORD *)(v1 + 8 * v11 + 8) = v10;
}
return v3;
}Referenced by:
MiObtainSystemCacheView