MiMarkBootGuardPage

void __fastcall MiMarkBootGuardPage(UINT64 a1){
  __int64 v2; 
  UINT64 v3; 
  unsigned __int64 PteShadow; 
  int v5; 
  _MMPFN *PfnDb; 
  _MMPFN *v7; 
  _MMPFN *v8; 
  _MI_PARTITION *v9; 
  unsigned __int64 Long; 
  _MI_PARTITION *v11; 
  int v12; 
  _MI_PAGE_DELETE_RESULT v13; 
  UINT64 v14; 

  if( (*(_BYTE *)a1 & 1) != 0 )
  {
    v2 = (__int64)((a1 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
    LODWORD(v3) = MI_READ_PTE_LOCK_FREE(a1);
    v14 = v3;
    PteShadow = v3;
    LOBYTE(v5) = MiPteInShadowRange((UINT64)&v14);
    if( v5 )
      PteShadow = MiReadPteShadow((__int64)&v14, PteShadow);
    PfnDb = MmGetPfnDb();
    v7 = &PfnDb[(PteShadow >> 12) & 0xFFFFFFFFFi64];
    v8 = &PfnDb[v7->u4._bf_0 & 0xFFFFFFFFFi64];
    LODWORD(v9) = MiPartitionIdToPointer(((unsigned __int64)v7->u4._bf_0 >> 39) & 0x3FF, (UINT64)PfnDb);
    Long = ZeroPte.u.Long;
    v11 = v9;
    LOBYTE(v12) = MiPteInShadowRange(a1);
    if( v12 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
      Long = ZeroPte.u.Long | 0x8000000000000000ui64;
    *(_QWORD *)a1 = Long;
    KeFlushSingleTb(v2, FlushKernel, 1i64);
    v13 = MiLockAndDecrementShareCount(v7, 1ui64);
    MiLockAndDecrementShareCount(v8, 0i64);
    MiReturnResident((INT64)v11, 1ui64);
    if( v13 != PageStillReferenced )
      MiReturnCommit(v11, 1ui64);
    if( v11 == &Irp )
    {
      if( MiGetSystemRegionType(v2) == 14 )
        _InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 571, 0xFFFFFFFFFFFFFFFFui64);
      else
        --*(&stru_140C4DB30 + 568);
    }
  }
}

Referenced by: