MiWalkPageTables

INT64 __fastcall MiWalkPageTables(INT64 a1){
  INT64 v1; 
  unsigned __int64 PteBase; 
  unsigned __int64 v3; 
  _MMPTE *PxeSelfRef; 
  int v5; 
  _MMPTE *PteLimit; 
  unsigned int v7; 
  unsigned int v8; 
  _MMPTE *v9; 
  __int64 v10; 
  unsigned int v11; 
  __int64 *v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  unsigned __int64 v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  unsigned __int64 v25; 
  unsigned __int64 v26; 
  UINT64 v27; 
  __int16 v28; 
  INT64 v29; 
  _MMPTE *v30; 
  INT64 v31; 
  __int64 i; 
  INT64 *v33; 
  INT64 v34; 
  int v35; 
  INT64 v37; 
  __int64 *v38; 
  _MMPTE *v39; 
  unsigned __int64 v40; 
  __int64 v41; 
  unsigned __int64 v42; 
  __int64 v43; 
  __int64 v44; 
  unsigned __int64 v45; 
  UINT64 v46; 
  unsigned __int64 v47; 
  unsigned __int64 v48; 
  __int64 v49; 
  _QWORD a2[6]; 
  int v52; 
  unsigned int v53; 
  unsigned int v54; 
  v1 = a1;
  if( !*(_BYTE *)(a1 + 5) )
    *(_BYTE *)(a1 + 5) = 15;
  PteBase = (unsigned __int64)MmGetPteBase();
  v3 = *(_QWORD *)(a1 + 56);
  *(_QWORD *)(a1 + 72) = *(_QWORD *)(qword_140C4E388 + 8i64 * *(unsigned __int16 *)(*(_QWORD *)(a1 + 24) + 174i64));
  PxeSelfRef = MmGetPxeSelfRef();
  if( v3 )
  {
    if( (_MMPTE *)v3 == PxeSelfRef )
    {
      v3 += 8i64;
      *(_QWORD *)(v1 + 56) = v3;
    }
    v5 = -1;
    if( v3 < PteBase || (PteLimit = MmGetPteLimit(), v3 > (unsigned __int64)PteLimit) )
    {
      v3 = 0i64;
      *(_QWORD *)(v1 + 56) = 0i64;
    }
    else
    {
      do
      {
        ++v5;
        v3 = (__int64)((v3 << 25) - (PteBase << 25)) >> 16;
      }
      while( v3 >= PteBase && v3 <= (unsigned __int64)PteLimit );
    }
    v42 = v3;
    v7 = 1;
    v43 = -1i64;
    if( v5 != -1 )
    {
      v44 = 0i64;
      v45 = v3 - 1;
      v7 = 2;
    }
  }
  else
  {
    v7 = 1;
    v42 = *(_QWORD *)(v1 + 32);
    v43 = *(_QWORD *)(v1 + 40);
  }
  v8 = MiInitializeWalkBounds(v1, a2);
  v11 = v10;
  v53 = v8;
  v12 = (__int64 *)&v42;
  v54 = v10;
  v13 = v8;
  v38 = (__int64 *)&v42;
  do
  {
    v52 = v10;
    v14 = v10;
    if( !v13 )
      goto LABEL_39;
    v15 = *v12;
    v16 = v12[1];
    v41 = *v12;
    v40 = v16;
    do
    {
      v17 = v15;
      v18 = a2[2 * v14 + 1];
      if( v15 > v18 )
        goto LABEL_37;
      v19 = a2[2 * v14];
      if( v16 < v19 )
        goto LABEL_37;
      if( v15 < v19 )
        v17 = a2[2 * v14];
      v20 = v16;
      if( v16 > v18 )
        v20 = a2[2 * v14 + 1];
      v21 = (unsigned __int64)v9 + ((v17 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 80) = v21;
      v22 = (unsigned __int64)v9 + ((v20 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 88) = v22;
      v23 = (unsigned __int64)v9 + ((v21 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 96) = v23;
      v24 = (unsigned __int64)v9 + ((v22 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 104) = v24;
      v25 = (unsigned __int64)v9 + ((v23 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 112) = v25;
      v26 = (unsigned __int64)v9 + ((v24 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 120) = v26;
      v27 = (UINT64)v9 + ((v25 >> 9) & 0x7FFFFFFFF8i64);
      *(_QWORD *)(v1 + 128) = v27;
      *(_QWORD *)(v1 + 136) = (char *)v9 + ((v26 >> 9) & 0x7FFFFFFFF8i64);
      v28 = *(_WORD *)v1;
      *(_QWORD *)(v1 + 64) = v10;
      if( (v28 & 4) != 0 )
      {
        v29 = *(_QWORD *)(v1 + 24);
        *(_BYTE *)(v1 + 2) |= 1u;
        v39 = (_MMPTE *)((char *)v9 + ((v27 >> 9) & 0x7FFFFFFFF8i64));
        v37 = v29;
        v46 = (UINT64)v9
            + (((unsigned __int64)((__int64)(((_QWORD)v39 << 25) - ((_QWORD)v9 << 25)) >> 16) >> 9) & 0x7FFFFFFFF8i64);
        v47 = (unsigned __int64)v9 + ((v46 >> 9) & 0x7FFFFFFFF8i64);
        v48 = (unsigned __int64)v9 + ((v47 >> 9) & 0x7FFFFFFFF8i64);
        v49 = (__int64)v9 + ((v48 >> 9) & 0x7FFFFFFFF8i64);
        v30 = MmGetPxeSelfRef();
        MiLockPageTableInternal(v29, (UINT64)v30, 0i64);
        for( i = 2i64; ; --i )
        {
          v33 = (INT64 *)*(&v46 + i);
          v34 = *v33;
          if( (*v33 & 0x81) != 1 )
            break;
          if( (v34 & 0x20) == 0 )
            MiPerformSafePdeWrite(v31, (INT64 *)*(&v46 + i), v34, 1);
          if( v33 != (INT64 *)v30 )
          {
            MiLockPageTableInternal(v37, (UINT64)v33, 0i64);
            MiUnlockPageTableInternal(v37, (UINT64)v30);
            v30 = (_MMPTE *)v33;
          }
          if( !i )
            break;
        }
        v1 = a1;
        v12 = v38;
        if( v30 != v39 )
        {
          MiUnlockPageTableInternal(v37, (UINT64)v30);
          v14 = v52;
          v13 = v53;
          goto LABEL_32;
        }
        v14 = v52;
        v13 = v53;
        *(_QWORD *)(a1 + 48) = v39;
      }
      else
      {
        *(_QWORD *)(v1 + 48) = v10;
        if( (v28 & 0x400) != 0 )
          ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)&dword_140C4E05C);
      }
      *(_BYTE *)(v1 + 2) &= ~1u;
LABEL_32:
      v35 = MiWalkPageTablesRecursively(v1, v27, 3i64);
      if( (*(_WORD *)v1 & 0x400) != 0 )
        ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&dword_140C4E05C);
      if( v35 >= 3 )
        return(unsigned int)v35;
      v16 = v40;
      v10 = 0i64;
      v9 = MmGetPteBase();
LABEL_37:
      v15 = v41;
      v52 = ++v14;
    }
    while( v14 < v13 );
    v11 = v54;
LABEL_39:
    ++v11;
    v12 += 2;
    v54 = v11;
    v38 = v12;
  }
  while( v11 < v7 );
  return 3i64;
}

Referenced by: