MiCompletePrivateZeroFault
NTSTATUS __stdcall MiCompletePrivateZeroFault(
_MI_ZERO_FAULT_PACKET *ZeroPacket,
_MMPFN *PfnClusterList,
UINT64 NumberOfPages){
UINT64 v3;
_MI_FAULT_VA_LIST *v4;
__int64 v5;
_MI_ZERO_FAULT_PACKET *v6;
unsigned __int64 PteBase;
__int64 v9;
UINT64 v10;
int v11;
__int64 v12;
__int64 v13;
__int64 v14;
int v15;
__int64 v16;
int v17;
__int64 v18;
unsigned int v19;
unsigned __int64 v20;
unsigned __int64 v21;
NTSTATUS v22;
unsigned __int64 v23;
unsigned __int64 v24;
unsigned __int64 v25;
int v26;
unsigned __int64 v27;
_MMPTE *PxeUserLimit;
unsigned __int64 v29;
_MMPFN *PfnDb;
UINT64 v31;
__int64 v32;
_MMPTE PteContents;
_MMPTE *Pml4eBase;
__int64 v35;
unsigned __int64 v36;
int v37;
_MIPFNBLINK *p_u2;
__int64 v39;
_MMPFN *v40;
volatile signed __int64 bf_0;
signed __int64 v42;
signed __int64 v43;
signed __int64 v44;
bool v45;
__int64 v46;
void *v47;
wchar_t *v48;
int v49;
unsigned __int64 v50;
int v51;
__int64 v52;
__int64 v53;
unsigned __int64 v54;
int v55;
unsigned __int64 v56;
_MMPFN *v57;
_ETHREAD *CurrentThread;
unsigned int SameThreadApcFlags;
unsigned int v60;
char v61;
UINT8 v62;
int v63;
unsigned __int8 v64;
_MI_PFN_CACHE_ATTRIBUTE v65;
_MMPFN *v66;
char v67;
unsigned __int64 v68;
__int64 v69;
__int64 v70;
int v71;
unsigned __int64 Long;
int v73;
_MMPTE *v74;
_EPROCESS *v75;
_MMVAD *Address;
__int64 v77;
_UNICODE_STRING *v78;
int v79;
__int16 v80;
int v81;
char v82;
__int16 v83;
_UNICODE_STRING *v84;
int v85;
char v86;
__int64 v87;
unsigned int v88;
__int64 v89;
_MMPFN *v90;
NTSTATUS v91;
unsigned int v92;
unsigned __int64 v93;
_MMPTE *v94;
_MMPFN *v95;
_MMPFN *v96;
__int64 v97;
_QWORD *v98;
_MI_FAULT_VA_LIST *VirtualFaultInfo;
int v101;
int v102;
_EPROCESS *Process;
int v104;
int v105;
_MMPFN *Pfn1;
UINT64 SpinCount;
UINT64 v108;
UINT64 v109;
unsigned __int64 v110;
UINT64 v111;
unsigned __int64 v112;
INT64 v113;
UINT64 v114;
_MI_FAULT_VA_LIST *FaultHead;
unsigned __int64 v116;
_MMVAD *v117;
__int64 v118;
_MMSUPPORT_INSTANCE *Vm;
unsigned __int64 v120;
unsigned __int64 v121;
unsigned __int64 v122;
__int64 v123;
_MMPFN *PfnClusterLista;
unsigned int v127;
v3 = NumberOfPages;
v4 = (_MI_FAULT_VA_LIST *)*((_QWORD *)ZeroPacket + 7);
v5 = *((_QWORD *)ZeroPacket + 2) >> 9;
v6 = ZeroPacket;
FaultHead = v4;
PteBase = (unsigned __int64)MmGetPteBase();
v9 = *((_QWORD *)ZeroPacket + 1);
v10 = PteBase + (v5 & 0x7FFFFFFFF8i64);
v114 = v10;
v101 = 0;
v11 = 0;
Vm = *(_MMSUPPORT_INSTANCE **)(v9 + 56);
v12 = *(_QWORD *)(v9 + 16);
if( (v12 & 1) != 0 )
{
if( *(_BYTE *)(v12 & 0xFFFFFFFFFFFFFFFEui64) == 3 )
v11 = 1;
v101 = v11;
}
v13 = (__int64)v4;
if( (*v6 & 8) == 0 )
v13 = 0i64;
v118 = v13;
Process = KeGetCurrentThread()->ApcState.Process;
v14 = *((_QWORD *)v6 + 8);
v116 = PteBase + ((*(_QWORD *)v9 >> 9) & 0x7FFFFFFFF8i64);
v15 = 16;
v117 = (_MMVAD *)v14;
v102 = 0;
if( v14 )
{
v16 = *(unsigned int *)(v14 + 52);
LODWORD(v16) = v16 & 0x7FFFFFFF;
if( (v16 | ((unsigned __int64)*(unsigned __int8 *)(v14 + 34) << 31)) == 0x7FFFFFFFEi64 )
v15 = 80;
}
v17 = v6[8];
v105 = v17;
if( (v17 & 2) == 0 || v10 > PteBase + 0x3FFFFFFF78i64 || v10 < PteBase )
{
v17 |= 0x80000000;
v105 = v17;
}
if( !v6[9] )
__incgsdword(0x2E9Cu);
v127 = 0;
v18 = v17 & 0x1F;
v19 = 0;
v20 = MmProtectToPteMask[v18] & 0xFFFF000000000E5Eui64 | 0x21;
if( v10 < PteBase || v10 > (unsigned __int64)MmGetPteLimit() )
{
v24 = MmProtectToPteMask[v18] & 0xFFFF000000000E5Eui64 | 0x121;
goto LABEL_41;
}
v21 = (__int64)((v10 << 25) - (PteBase << 25)) >> 16;
if( v10 >= (unsigned __int64)MmGetPdeBase() && v10 <= (unsigned __int64)MmGetPdeLimit() )
{
if( (_MMPTE *)v10 == MmGetPxeSelfRef() )
{
v20 = MmProtectToPteMask[v18] & 0x7FFF000000000E5Ei64 | 0x8000000000000021ui64;
}
else if( (v17 & 0x4000000) == 0 )
{
v20 = MmProtectToPteMask[v18] & 0x7FFF000000000E5Ei64 | 0x21;
}
v22 = MiUserPdeOrAbove(v10);
PteBase = (unsigned __int64)MmGetPteBase();
if( v22 )
v20 |= 4ui64;
}
v23 = v20;
v24 = v20 | 4;
if( v10 > PteBase + 0x3FFFFFFF78i64 )
v24 = v23;
if( (v17 & 0x4000000) != 0 )
{
LODWORD(v25) = MiGetLeafVa(v21);
v21 = v25;
}
if( v21 < 0xFFFF800000000000ui64 )
{
v26 = *(&stru_140C4DB30 + 537);
LABEL_38:
if( v26 )
v24 |= 0x100ui64;
goto LABEL_40;
}
if( MiGetSystemRegionType(v21) != 1
&& (v21 < (unsigned __int64)MmGetPteBase() || v21 > (unsigned __int64)MmGetPteLimit()) )
{
if( v21 < *(&stru_140C4DB30 + 937) || (v26 = *(&stru_140C4DB30 + 537), v21 > *(&stru_140C4DB30 + 175)) )
v26 = *(&stru_140C4DB30 + 536);
goto LABEL_38;
}
LABEL_40:
v3 = NumberOfPages;
v19 = 0;
LABEL_41:
if( v17 < 0 && (v17 & 5) == 4 )
v24 |= 0x42ui64;
v27 = v24 & 0xFFFFFFFFFFFFFFFBui64;
if( (v17 & 0x40000000) == 0 )
v27 = v24;
if( (v17 & 0x20000000) != 0 )
v27 ^= ((unsigned __int16)v27 ^ (unsigned __int16)(*(&stru_140C4DB30 + 536) << 8)) & 0x100;
PxeUserLimit = MmGetPxeUserLimit();
v29 = v27 & 0xFFFFFFFFFFFFFEFFui64;
PfnDb = MmGetPfnDb();
v31 = 0i64;
if( (v17 & 0x8000000) == 0 )
v29 = v27;
v111 = 0i64;
v32 = v29 | 0x80;
if( (v17 & 0x4000000) == 0 )
v32 = v29;
PteContents.u.Long = v32 & 0xF0FFFFFFFFFFFFFFui64 | 0xA00000000000000i64;
Pml4eBase = MmGetPml4eBase();
if( !v3 )
{
LABEL_201:
v90 = MmGetPfnDb();
v91 = 273;
goto LABEL_202;
}
while( 1 )
{
v35 = *(_QWORD *)v10;
if( v10 >= (unsigned __int64)Pml4eBase && v10 <= (unsigned __int64)PxeUserLimit )
v31 = v111;
if( v6[9] )
{
if( (v35 & 0x400) == 0 && (v35 & 0x4000000) != 0 && !v31 )
PteContents.u.Long |= 0x40;
}
else if( !v35 )
{
v35 = 32i64 * (v6[8] & 0x1F);
v127 = v19 + 1;
if( *(&stru_140C4DB30 + 42) )
{
if( (v35 & *(&stru_140C4DB30 + 42)) != 0 )
v35 |= 0x10ui64;
else
v35 |= *(&stru_140C4DB30 + 42);
}
v36 = v35;
LOBYTE(v37) = MiPteInShadowRange(v10);
if( v37 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v35 & 1) != 0 )
v36 = v35 | 0x8000000000000000ui64;
*(_QWORD *)v10 = v36;
PfnDb = MmGetPfnDb();
}
p_u2 = &PfnClusterList->u2;
Pfn1 = PfnClusterList;
v39 = PfnClusterList->u2._bf_0 & 0xFFFFFFFFFi64;
v40 = PfnClusterList;
if( v39 == 0xFFFFFFFFFi64 )
PfnClusterLista = 0i64;
else
PfnClusterLista = &PfnDb[v39];
bf_0 = p_u2->_bf_0;
v42 = _InterlockedCompareExchange64(&p_u2->Lock, p_u2->_bf_0 & 0xFFFFFFF000000000ui64, p_u2->_bf_0);
if( bf_0 != v42 )
{
do
{
v43 = v42;
v42 = _InterlockedCompareExchange64(&p_u2->Lock, v42 & 0xFFFFFFF000000000ui64, v42);
}
while( v43 != v42 );
}
v44 = PfnClusterList - MmGetPfnDb();
v45 = v6[9] == 0;
v113 = v44;
if( !v45 && !*((_QWORD *)v6 + 9) && (v35 & 0x400) != 0 )
{
v46 = v35;
if( *(&stru_140C4DB30 + 42) && (v35 & 0x10) == 0 )
v46 = v35 & ~*(&stru_140C4DB30 + 42);
if( v46 >> 16 )
{
LODWORD(SpinCount) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)p_u2, 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( p_u2->_bf_0 < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)p_u2, 0x3Fui64) );
v40 = PfnClusterList;
}
v40->u4._bf_0 = v40->u4._bf_0 & 0x8FFFFFFFFFFFFFFFui64 | 0x4000000000000000i64;
_InterlockedAnd64(&p_u2->Lock, 0x7FFFFFFFFFFFFFFFui64);
}
else if( (v35 & 0x3E0) != 0 )
{
v35 &= ~0x400ui64;
}
else
{
v35 = 0i64;
}
v47 = MiMapPageInHyperSpaceWorker(v44, 0i64, 0x80000000ui64);
memset64(v47, v35 & 0xFFFFFFFFFFFFFFFDui64, 0x200ui64);
MiUnmapPageInHyperSpaceWorker(v47, 0x11u, 0x80000000ui64);
v35 = MiSwizzleInvalidPte(128i64);
v15 |= 8u;
v40 = PfnClusterList;
}
v48 = (wchar_t *)(unsigned int)v6[8];
v49 = v15 | 0x20;
v50 = *(_QWORD *)v10;
if( (*v6 & 4) == 0 )
v49 = v15;
v51 = v49 | 0x20;
if( (v6[8] & 2) == 0 )
v51 = v49;
v104 = v51;
if( (v51 & 4) != 0 )
{
v52 = 32i64 * (v6[8] & 0x1F);
if( v50 )
v50 = v52 | v50 & 0xFFFFFFFFFFFFFC1Fui64;
else
v50 = MiSwizzleInvalidPte(v52);
}
v53 = -9i64;
if( (v50 & 0x400) != 0 )
v53 = -2049i64;
v54 = v50 & v53;
v40->OriginalPte.u.Long = v54;
if( (v51 & 2) != 0 )
{
v40->u4._bf_0 |= 0x8000000000000000ui64;
}
else if( (v51 & 8) == 0 )
{
v40->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 &= 0xFFFFFFFFFFFFC00Fui64;
v40->OriginalPte.u.Long = v54 & 0xFFFFFFFFFC00FFFFui64;
}
if( (_DWORD)v48 )
{
if( (_DWORD)v48 == 31 )
{
v55 = 1;
}
else if( (unsigned int)v48 >> 3 == 3 && ((unsigned __int8)v48 & 7) != 0 )
{
v55 = 2;
}
else
{
v55 = (unsigned int)v48 >> 3 != 1;
}
}
else
{
v55 = 3;
}
v40->u3.ReferenceCount = 1;
v110 = *(unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + ((v10 >> 9) & 0x7FFFFFFFF8i64));
v56 = (v110 >> 12) & 0xFFFFFFFFFi64;
v40->u4._bf_0 = v56 | v40->u4._bf_0 & 0xFFFFFFF000000000ui64;
v57 = &MmGetPfnDb()[v56];
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
SameThreadApcFlags = CurrentThread->SameThreadApcFlags;
if( (SameThreadApcFlags & 0x100) != 0 )
{
v60 = SameThreadApcFlags >> 9;
}
else
{
v60 = (CurrentThread->CrossThreadFlags >> 12) & 7;
if( (CurrentThread->Tcb.Process->Flags & 0x100000) != 0 )
{
v61 = 2;
if( v60 < 2 )
v61 = v60;
LOBYTE(v60) = v61;
}
}
v62 = 17;
v63 = v51 & 1;
if( (v51 & 1) == 0 )
{
if( (v51 & 0x10) != 0 )
{
HIDWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)p_u2, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( p_u2->_bf_0 < 0 );
}
}
else
{
v62 = MiLockPageInline(v40);
}
}
LODWORD(v108) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v57->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v108);
while( v57->u2._bf_0 < 0 );
}
v57->u2._bf_0 ^= ((v57->u2._bf_0 + 1) ^ v57->u2._bf_0) & 0x3FFFFFFFFFFFFFFFi64;
_InterlockedAnd64(&v57->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
v64 = *((_BYTE *)&Pfn1->u3 + 2);
if( v64 >> 6 == v55 )
{
v66 = Pfn1;
}
else
{
v65 = v55;
v66 = Pfn1;
MiChangePageAttribute(Pfn1, v65, 1ui64);
v64 = *((_BYTE *)&Pfn1->u3 + 2);
}
p_u2->_bf_0 = p_u2->_bf_0 & 0xC000000000000000ui64 | 1;
v67 = v60 ^ *((_BYTE *)&v66->u3 + 3);
v68 = v114;
v66->PteLong = v114;
*((_BYTE *)&v66->u3 + 3) ^= v67 & 7;
*((_BYTE *)&v66->u3 + 2) = v64 & 0xF8 | 6;
if( (v104 & 0x20) == 0 )
*((_BYTE *)&v66->u3 + 2) |= 0x10u;
if( (v104 & 0x40) != 0 )
*((_BYTE *)&v66->u3 + 3) |= 0x20u;
if( !v63 )
{
_InterlockedAnd64(&p_u2->Lock, 0x7FFFFFFFFFFFFFFFui64);
if( (v104 & 0x10) == 0 )
__writecr8(v62);
}
v15 = v104;
if( (v104 & 8) != 0 )
v66->OriginalPte.u.Long = v35;
v6 = ZeroPacket;
if( (*ZeroPacket & 4) != 0 )
{
LODWORD(v69) = MiMakeTransitionPte(v113, ZeroPacket[8]);
v70 = v69;
LOBYTE(v71) = MiPteInShadowRange(v68);
if( v71 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v70 & 1) != 0 )
v70 |= 0x8000000000000000ui64;
*(_QWORD *)v68 = v70;
if( (*ZeroPacket & 0x40) != 0 )
_InterlockedExchangeAdd64((volatile signed __int64 *)&Process->NumberOfPrivatePages, 1ui64);
MiLockAndDecrementShareCount(v66, 0i64);
if( FaultHead
&& (__int64)((v68 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16 == *(_QWORD *)(*((_QWORD *)FaultHead + 1)
+ 16i64
* *((_QWORD *)FaultHead + 3))
+ (*((_QWORD *)FaultHead + 4) << 12)
&& *(_BYTE *)FaultHead != 5 )
{
MiAdvanceFaultList(FaultHead);
}
goto LABEL_200;
}
PteContents.u.Long = (PteContents.u.Long ^ (v113 << 12)) & 0xFFFFFFFFF000i64 ^ PteContents.u.Long | 0x20;
if( *((_QWORD *)ZeroPacket + 9) )
{
Long = PteContents.u.Long;
LOBYTE(v73) = MiPteInShadowRange(v68);
if( v73 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (PteContents.u.Long & 1) != 0 )
Long = PteContents.u.Long | 0x8000000000000000ui64;
*(_QWORD *)v68 = Long;
goto LABEL_200;
}
if( v68 == v116
|| (*ZeroPacket & 0x80u) == 0
|| (PteContents.u.Long &= ~0x20ui64, v105 >= 0)
|| (v74 = MmGetPteBase(), v68 > (unsigned __int64)&v74[0x7FFFFFFEFi64]) )
{
v75 = Process;
}
else
{
v75 = Process;
if( v68 >= (unsigned __int64)v74 && (Process->Flags & 0x8000) != 0 )
{
if( v102 )
{
if( v102 == 2 )
PteContents.u.Long &= 0xFFFFFFFFFFFFFFBDui64;
}
else
{
Address = v117;
if( !v117 )
Address = MiLocateAddress(*((VOID **)ZeroPacket + 2));
if( (Address->Core.u.LongFlags & 0x300000) == 3145728 )
{
v102 = 2;
PteContents.u.Long &= 0xFFFFFFFFFFFFFFBDui64;
}
else
{
v102 = 1;
}
}
}
}
v77 = *((_QWORD *)ZeroPacket + 1);
v78 = (_UNICODE_STRING *)*(unsigned __int8 *)(v77 + 69);
if( ((unsigned __int8)v78 & 5) != 4 || ((unsigned __int8)v78 & 2) != 0 )
{
v88 = v101 & 0xFFFFFFFB;
v101 &= ~4u;
goto LABEL_196;
}
v79 = *(unsigned __int16 *)(v77 + 66);
v80 = 511;
if( (_WORD)v79 )
{
if( v79 + *(unsigned __int16 *)(v77 + 64) == (((unsigned int)v68 >> 3) & 0x1FF) )
{
LOBYTE(v78) = (unsigned __int8)v78 & 0x10;
LOBYTE(v81) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v66, v78, 0xFFu, v48);
if( v81 )
{
if( !v82 )
goto LABEL_186;
}
else if( v82 )
{
goto LABEL_186;
}
}
MiEmptyDeferredWorkingSetEntries(v77 + 56);
v80 = 511;
}
LABEL_186:
v83 = *(_WORD *)(v77 + 66);
if( v83 )
{
*(_WORD *)(v77 + 66) = v83 + 1;
}
else
{
v84 = (_UNICODE_STRING *)*(unsigned __int8 *)(v77 + 69);
*(_WORD *)(v77 + 66) = 1;
*(_WORD *)(v77 + 64) = v80 & ((unsigned int)v68 >> 3);
LOBYTE(v85) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v66, v84, v80, v48);
if( v85 )
*(_BYTE *)(v77 + 69) = v86 & 0xEF;
else
*(_BYTE *)(v77 + 69) = v86 | 0x10;
}
v87 = *((_QWORD *)ZeroPacket + 1);
v88 = v101 | 4;
v101 |= 4u;
if( (*(_BYTE *)(v87 + 69) & 8) != 0 )
{
v89 = *(_QWORD *)(v87 + 16);
if( (v89 & 1) == 0 || *(_BYTE *)(v89 & 0xFFFFFFFFFFFFFFFEui64) != 2 )
PteContents.u.Long &= ~0x20ui64;
}
LABEL_196:
LODWORD(VirtualFaultInfo) = v88;
if( !MiAllocateWsle(Vm, (_MMPTE *)v68, v66, 0i64, PteContents, VirtualFaultInfo) )
break;
if( (*ZeroPacket & 0x40) != 0 )
_InterlockedExchangeAdd64((volatile signed __int64 *)&v75->NumberOfPrivatePages, 1ui64);
__incgsdword(0x2E9Cu);
LABEL_200:
v10 = v68 + 8;
PfnClusterList = PfnClusterLista;
v31 = v111 + 1;
v19 = v127;
v111 = v31;
v114 = v10;
PxeUserLimit = MmGetPxeUserLimit();
Pml4eBase = MmGetPml4eBase();
if( v31 >= NumberOfPages )
goto LABEL_201;
PfnDb = MmGetPfnDb();
}
v90 = MmGetPfnDb();
v95 = &v90[v66->u4._bf_0 & 0xFFFFFFFFFi64];
HIDWORD(v108) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v66->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&v108 + 4));
while( v66->u2._bf_0 < 0 );
}
MiCapturePageFileInfoInline(&v66->OriginalPte, 1ui64, 0i64);
v66->OriginalPte.u.Long &= ~2ui64;
v66->u2._bf_0 |= 0x4000000000000000ui64;
MiDecrementShareCount(v66);
_InterlockedAnd64(&v66->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
MiLockAndDecrementShareCount(v95, 0i64);
v91 = -1073741801;
MiFreePageChain(PfnClusterLista);
LABEL_202:
if( !v6[9] && v127 )
{
v92 = 0;
v93 = *((_QWORD *)v6 + 2);
v94 = MmGetPteBase();
while( v93 > 0x7FFFFFFEFFFFi64 )
{
++v92;
v93 = (__int64)((v93 << 25) - ((_QWORD)v94 << 25)) >> 16;
if( v92 >= 3 )
return v91;
}
v112 = *(unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long + ((*((_QWORD *)v6 + 2) >> 18) & 0x3FFFFFF8i64));
v96 = &v90[(v112 >> 12) & 0xFFFFFFFFFi64];
LODWORD(v109) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v96->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v109);
while( v96->u2._bf_0 < 0 );
}
v96->OriginalPte.u.Long ^= ((unsigned int)v96->OriginalPte.u.Long ^ ((unsigned int)v96->OriginalPte.u.Long
+ ((unsigned __int16)v127 << 16))) & 0x3FF0000;
_InterlockedAnd64(&v96->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
if( v127 <= 1
&& ((__int64)(v96->PteLong | 0x8000000000000000ui64) >> 47 == -1
|| (__int64)(v96->PteLong | 0x8000000000000000ui64) >> 47 == 0) )
{
v120 = (unsigned __int64)v94 + (((v96->PteLong | 0x8000000000000000ui64) >> 9) & 0x7FFFFFFFF8i64);
v121 = (unsigned __int64)v94 + ((v120 >> 9) & 0x7FFFFFFFF8i64);
v122 = (unsigned __int64)v94 + ((v121 >> 9) & 0x7FFFFFFFF8i64);
v123 = (__int64)v94 + ((v122 >> 9) & 0x7FFFFFFFF8i64);
v97 = 4i64;
do
v98 = *(&Vm + v97--);
while( (*v98 & 1) != 0 && (*v98 & 0x80u) == 0i64 && v97 );
}
}
return v91;
}Referenced by:
MiResolvePrivateZeroFault