MiMakeProtoTransition
VOID __stdcall MiMakeProtoTransition(_MMPFN *Pfn1){
unsigned __int64 v2;
_LIST_ENTRY *Blink;
__int64 v4;
UINT64 *v5;
UINT64 v6;
UINT64 v7;
UINT64 v8;
char v9;
UINT64 v10;
int v11;
UINT64 v12;
LODWORD(v2) = MI_READ_PTE_LOCK_FREE((INT64)&Pfn1->OriginalPte.u.Hard);
Blink = Pfn1->ListEntry.Blink;
v4 = (v2 >> 5) & 0x1F;
v5 = (UINT64 *)((char *)MiMapPageInHyperSpaceWorker(Pfn1->u4._bf_0 & 0xFFFFFFFFFi64, 0i64, 0x80000000ui64)
+ 8 * (((unsigned __int64)Blink >> 3) & 0x1FF));
LODWORD(v6) = MI_READ_PTE_LOCK_FREE((INT64)v5);
v12 = v6;
v7 = v6;
MiPteInShadowRange((UINT64)&v12);
LODWORD(v8) = MiMakeTransitionPte((v7 >> 12) & 0xFFFFFFFFFi64, v4);
v12 = v8;
v9 = v8;
v10 = v8;
LOBYTE(v11) = MiPteInShadowRange((UINT64)v5);
if( v11 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v9 & 1) != 0 )
v10 |= 0x8000000000000000ui64;
*v5 = v10;
MiUnmapPageInHyperSpaceWorker(v5, 0x11u, 0x80000000ui64);
}Referenced by:
MiDeletePteList