MiCombineCandidate

INT64 __fastcall MiCombineCandidate(_MI_PAGE_COMBINING_SUPPORT *Pcs, _MMPFN *InputPfn){
  __int64 v2; 
  char v3; 
  __int128 v4; 
  __int128 v5; 
  unsigned __int64 Buffer; 
  __int64 v7; 
  int v8; 
  unsigned __int64 v9; 
  __int64 v10; 
  unsigned __int64 PteBase; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  int v15; 
  unsigned int v16; 
  __int64 v17; 
  unsigned __int64 v19; 
  UNICODE_STRING antNameA; 
  __int128 v21; 
  __int128 v22; 
  __int64 a1; 
  v3 = (char)InputPfn;
  v4 = *(_OWORD *)(v2 + 16);
  antNameA = *(UNICODE_STRING *)v2;
  v5 = *(_OWORD *)(v2 + 32);
  v21 = v4;
  v22 = v5;
  if( (BYTE2(v5) & 7u) <= 1 )
    return 0i64;
  Buffer = (unsigned __int64)antNameA.Buffer;
  v7 = (*((_QWORD *)&v22 + 1) >> 39) & 0x3FFi64;
  if( *(_MI_PARTITION **)(qword_140C4E388 + 8 * v7) != Pcs->Partition && (v3 & 1) == 0 )
    return 0i64;
  LOBYTE(v8) = MI_PFN_IS_PROTO(&antNameA, (UNICODE_STRING *)v7, BYTE8(v22), (PWCHAR)v2);
  if( v8 )
    return 0i64;
  if( (v9 & 0x1000000000i64) != 0 )
    return 0i64;
  if( (BYTE3(v22) & 8) != 0 )
    return 0i64;
  PteBase = (unsigned __int64)MmGetPteBase();
  if( Buffer < PteBase
    || Buffer > (unsigned __int64)MmGetPteLimit()
    || (*((_QWORD *)&v21 + 1) & 0x4000000000000000i64) != 0
    || ((v9 >> 60) & 7) == 4
    || (Buffer | 0x8000000000000000ui64) <= PteBase + 0x3FFFFFFF78i64
    && (Buffer | 0x8000000000000000ui64) >= PteBase
    && (BYTE3(v22) & 0x20) != 0 )
  {
    return 0i64;
  }
  if( byte_140C51D9E
    && _bittest64((const signed __int64 *)qword_140C522C8, (unsigned __int64)((v10 - (__int64)MmGetPfnDb()) / 48) >> 9) )
  {
    return 0i64;
  }
  v12 = v21;
  a1 = v21;
  if( (v21 & 1) != 0 || (_QWORD)v21 && qword_140C4DC80 && (qword_140C4DC80 & (unsigned __int64)v21) == 0 )
    return 0i64;
  v13 = ((unsigned __int64)v21 >> 5) & 0x1F;
  if( (_DWORD)v13 == 24
    || (_DWORD)v13 == 31
    || (((unsigned __int64)v21 >> 5) & 0x18) == 16
    || (unsigned int)v13 >= 0x1E
    || (unsigned int)MiGetPagePrivilege((ULONG_PTR)&antNameA, 0, 0i64) )
  {
    return 0i64;
  }
  v14 = (__int64)((Buffer << 25) - (PteBase << 25)) >> 16;
  if( v14 >= 0xFFFF800000000000ui64 )
    v15 = *((unsigned __int8 *)&antNameB + ((v14 >> 39) & 0x1FF) - 256);
  else
    v15 = 0;
  if( Buffer > PteBase + 0x3FFFFFFF78i64 )
  {
    if( v15 == 6 )
    {
      v16 = 2;
    }
    else
    {
      if( v15 != 1 || (unsigned int)MiIsSessionMetadata((PVOID)v14) )
        return 0i64;
      v16 = 3;
    }
  }
  else
  {
    v16 = 1;
  }
  v17 = BYTE2(v22) & 7;
  if( (unsigned __int8)(v17 - 2) > 1u || (_WORD)v22 )
  {
    if( (_BYTE)v17 != 6
      || (antNameA.Length & 1) == 0
      || (*((_QWORD *)&v22 + 1) & 0xFFFFFFFFFi64) == 0xFFFFFFFFDi64
      || (_WORD)v22 != 1
      || (*((_QWORD *)&v21 + 1) & 0x3FFFFFFFFFFFFFFFi64) != 1 )
    {
      return 0i64;
    }
    if( v16 == 1 && (v12 & 0x400) == 0 )
    {
      if( (v12 & 0x800) == 0
        && (((unsigned __int8)v12 >> 2) & (unsigned __int8)v22) == 0
        && (((unsigned __int8)v12 >> 1) & (unsigned __int8)v22) == 0 )
      {
        v19 = v12;
        if( qword_140C4DC80 && (v12 & 0x10) == 0 )
          v19 = v12 & ~qword_140C4DC80;
        if( HIDWORD(v19) == 1 )
          return 0i64;
      }
      if( (v12 & 0x400) == 0 && ((v12 >> 26) & 1) != 0 )
        return 0i64;
    }
  }
  else if( v16 == 1 && (MI_IS_RESET_PTE(v12) || (unsigned int)MI_IS_SOFTWARE_PTE_SHADOW_STACK(&a1)) )
  {
    return 0i64;
  }
  return v16;
}

Referenced by: