MiClearPageFileHash
void __fastcall MiClearPageFileHash(__int64 a1, unsigned int a2){
__int64 v2;
unsigned __int64 v4;
INT64 *v5;
INT64 v6;
unsigned __int64 v7;
struct _SLIST_ENTRY *v8;
INT64 Next;
__int64 v10;
UINT64 updated;
unsigned __int64 v12;
v2 = *(_QWORD *)(a1 + 216);
if( v2 )
{
v4 = v2 + 4i64 * a2;
v12 = v4;
v5 = (INT64 *)((char *)MmGetPteBase() + ((v4 >> 9) & 0x7FFFFFFFF8i64));
v6 = MI_READ_PTE_LOCK_FREE((INT64)v5);
updated = v6;
v7 = v6;
if( (v6 & 1) != 0 )
{
*(_DWORD *)v4 = 1;
MiPteInShadowRange((UINT64)&updated);
v8 = (struct _SLIST_ENTRY *)((char *)MmGetPfnDb() + 48 * ((v7 >> 12) & 0xFFFFFFFFFi64));
Next = (INT64)v8[1].Next;
HIDWORD(v10) = HIDWORD(Next);
if( qword_140C4DC80 && (Next & 0x10) == 0 )
v10 = Next & ~qword_140C4DC80;
updated = MiUpdatePageFileHighInPte(Next, (unsigned int)(HIDWORD(v10) - 1));
v8[1].Next = (_SLIST_ENTRY *)updated;
if( HIDWORD(v10) == 1 )
{
--*(_DWORD *)(a1 + 208);
*v5 = ZeroPte;
KeFlushSingleTb(v12, 0i64, 1i64);
RtlpInterlockedPushEntrySList((PSLIST_HEADER)(a1 + 80), v8);
}
}
else
{
if( qword_140C4DC80 && (v6 & 0x10) == 0 )
v6 &= ~qword_140C4DC80;
*v5 = MiUpdatePageFileHighInPte(v7, (unsigned int)(HIDWORD(v6) - 1));
}
}
}Referenced by:
MiReleasePageFileInfo