MiCaptureDeleteHierarchy

VOID __stdcall MiCaptureDeleteHierarchy(
        VOID *StartingAddress,
        VOID *EndingAddress,
        UINT8 WsIrql,
        _MI_DELETED_PAGE_TABLE_LEVEL_BITS *DeletedHierarchyBits){
  _MMPTE *PdeBase; 
  _MMPTE *PteBase; 
  _MI_DELETED_PAGE_TABLE_LEVEL_BITS *v8; 
  __int64 v9; 
  __int64 *v10; 
  unsigned int v11; 
  __int64 v12; 
  UINT64 Flags; 
  __int64 v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 

  DeletedHierarchyBits->EntireField = 0;
  PdeBase = MmGetPdeBase();
  PteBase = MmGetPteBase();
  v8 = DeletedHierarchyBits;
  v9 = 2i64;
  do
  {
    v16 = (unsigned __int64)PdeBase + (((unsigned __int64)StartingAddress >> 18) & 0x3FFFFFF8);
    v15 = (unsigned __int64)PteBase + ((v16 >> 9) & 0x7FFFFFFFF8i64);
    v10 = &v14;
    v14 = (__int64)PteBase + ((v15 >> 9) & 0x7FFFFFFFF8i64);
    v11 = 0;
    while( 1 )
    {
      v12 = *(_QWORD *)*v10;
      if( !v12 )
        break;
      if( (v12 & 1) == 0 && v11 != 2 )
      {
        LODWORD(Flags) = 1;
        MiMakeSystemAddressValid((VOID *)(((*v10 << 25) - ((_QWORD)PteBase << 25)) >> 16), 0i64, 0i64, WsIrql, Flags);
        PteBase = MmGetPteBase();
      }
      ++v11;
      ++v10;
      if( v11 >= 3 )
        goto LABEL_6;
    }
    v8->AddressLevels[0] = 1 << (2 - v11);
LABEL_6:
    v8 = (_MI_DELETED_PAGE_TABLE_LEVEL_BITS *)((char *)v8 + 1);
    PdeBase = MmGetPdeBase();
    StartingAddress = EndingAddress;
    --v9;
  }
  while( v9 );
}

Referenced by: