MiDeleteAweInfoPages
INT64 __fastcall MiDeleteAweInfoPages(INT64 a1){
_ETHREAD *CurrentThread;
INT64 v2;
UINT64 v3;
INT64 v4;
_DWORD *v5;
INT64 v6;
int v7;
UINT64 *v8;
UINT64 SetBits;
UINT64 v10;
UINT64 NextForwardRunClear;
UINT64 v12;
UINT64 v13;
UINT64 v14;
__int64 v15;
__int64 v16;
UINT64 v17;
char *v18;
int v19;
_MMPFN *PfnDb;
__int64 v21;
INT64 AweInfoPartition;
_ETHREAD *v24;
UINT64 v26;
__int64 v27;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v2 = 0i64;
v26 = 0i64;
v3 = 0i64;
v4 = 0i64;
v24 = CurrentThread;
v5 = (_DWORD *)a1;
AweInfoPartition = MiGetAweInfoPartition(a1);
MiLockAwePagesExclusive((INT64)v5, (INT64)CurrentThread);
v6 = ExGetCallBackBlockRoutine((INT64)v5);
v7 = *v5;
v8 = (UINT64 *)(v5 + 4);
v27 = v6;
if( (v7 & 1) == 0 || *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2032i64) )
{
do
{
SetBits = RtlFindSetBitsEx(v8, 1ui64, v3);
v10 = SetBits;
if( SetBits < v3 || SetBits == -1i64 )
break;
NextForwardRunClear = RtlFindNextForwardRunClearEx((INT64)v8, SetBits, &v26);
v12 = v26;
v13 = NextForwardRunClear;
if( !NextForwardRunClear )
v12 = *v8;
v14 = v12 - v10;
RtlClearBitsEx((INT64)v8, v10, v14);
v15 = v27;
v3 = v10 + v14 + v13;
v16 = v27 * v10;
v4 += v27 * v14;
v17 = 0i64;
v18 = (char *)MmGetPfnDb() + 48 * v16;
v19 = (unsigned __int8)v18[34] >> 6;
if( v14 )
{
PfnDb = MmGetPfnDb();
v21 = 48 * v27;
do
{
if( (unsigned __int8)v18[34] >> 6 != v19 )
{
MiFreeMdlPageRun(v16, v17, 0i64);
v19 = (unsigned __int8)v18[34] >> 6;
v15 = v27;
v17 = 0i64;
v16 = (v18 - (char *)PfnDb) / 48;
}
v17 += v15;
v18 += v21;
--v14;
}
while( v14 );
v5 = (_DWORD *)a1;
v8 = (UINT64 *)(a1 + 16);
}
MiFreeMdlPageRun(v16, v17, 0i64);
}
while( v3 < *v8 );
if( v4 )
{
_InterlockedExchangeAdd64((volatile signed __int64 *)(AweInfoPartition + 7608), -v4);
if( (ULONG_PTR *)AweInfoPartition == &MiSystemPartition )
_InterlockedExchangeAdd64(&qword_140C4ECF8, -v4);
}
CurrentThread = v24;
v2 = v4;
}
MiUnlockAwePagesExclusive((INT64)v5, (INT64)CurrentThread);
return v2;
}Referenced by:
MiDeleteSectionAwe
MmCleanProcessAddressSpace