MiCopyPage

void __fastcall MiCopyPage(ULONG_PTR a1, ULONG_PTR a2, __int128 *a3, int a4){
  _MMPFN *PfnDb; 
  char v8; 
  UNICODE_STRING *v9; 
  UINT64 v10; 
  int v11; 
  unsigned int PagePrivilege; 
  INT64 v13; 
  WCHAR *v14; 
  int v15; 
  unsigned __int8 v16; 
  int v17; 
  int v18; 
  _MMPTE *PteBase; 
  unsigned __int8 v20; 
  int v21; 
  NTSTATUS v22; 
  INT64 v23; 
  unsigned __int8 CurrentIrql; 
  UINT64 HyperSpace; 
  UINT64 *PteFromCopyList; 
  unsigned __int64 v27; 
  _MMPTE *Pml4eBase; 
  _MMPTE *PxeUserLimit; 
  unsigned __int64 v30; 
  unsigned __int64 *v31; 
  unsigned __int8 v32; 
  __int64 v33; 
  int v34; 
  UINT64 v35; 
  LARGE_INTEGER ThawTimeout[2]; 
  __int128 v37; 
  __int128 v38; 
  __int64 v39; 
  int v42; 
  v39 = 0i64;
  PfnDb = MmGetPfnDb();
  v8 = 0;
  v38 = 0i64;
  v37 = 0i64;
  *(_OWORD *)&ThawTimeout[0].LowPart = 0i64;
  v9 = (UNICODE_STRING *)((char *)PfnDb + 48 * a2);
  v35 = (UINT64)v9;
  v10 = (UINT64)PfnDb + 48 * a1;
  v11 = -1073741823;
  v42 = a4 & 4;
  v34 = v42 != 0 ? 4 : 0;
  PagePrivilege = MiGetPagePrivilege((ULONG_PTR)v9, v42, (unsigned __int64 *)&v37);
  v15 = 2;
  v16 = PagePrivilege;
  if( PagePrivilege )
  {
    if( (a4 & 0x12) != 0 )
    {
      v8 = 2;
      v17 = a4 & 2;
    }
    else if( (MiFlags & 0x10000) == 0
           || (a4 & 8) != 0
           || (PagePrivilege & 1) == 0
           || (LOBYTE(v18) = MI_PFN_IS_PROTO(v9, (UNICODE_STRING *)PagePrivilege, 2u, v14), v18) )
    {
      if( (MiFlags & 0x40000) == 0 || (a4 & 8) != 0 || (v8 = v15, (v16 & (unsigned __int8)v15) == 0) )
        v8 = 4;
      v17 = v15 & a4;
    }
    else
    {
      v8 = v15;
      v17 = v15 & a4;
    }
  }
  else
  {
    v17 = a4 & 2;
    if( (a4 & 2) == 0 )
      v8 = 4;
  }
  PteBase = MmGetPteBase();
  if( ((unsigned __int8)v8 & (unsigned __int8)v15) != 0 )
  {
    v20 = 17;
    if( (MiFlags & 0x40000) != 0 )
    {
      MiFlushEntireTbDueToAttributeChange(v13, PteBase);
      PteBase = MmGetPteBase();
    }
    if( (MiFlags & 0x8000) == 0 )
      goto LABEL_31;
    if( v17 )
    {
      *(_OWORD *)&ThawTimeout[0].LowPart = v37;
    }
    else
    {
      ThawTimeout[0].QuadPart = (__int64)((*(_QWORD *)(v10 + 8) << 25) - ((_QWORD)PteBase << 25)) >> 16;
      if( ThawTimeout[0].QuadPart < 0xFFFF800000000000ui64 )
      {
        v8 |= 8u;
        ThawTimeout[1] = *(LARGE_INTEGER *)(*((_QWORD *)KeGetCurrentThread() + 23) + 992i64);
        if( !v42 )
          v20 = MiLockPageInline(v10);
        MiMarkPfnVerified(v10, 4);
        MiAbortCombineScan(v10);
        v21 = v42;
        if( v42 )
          goto LABEL_28;
        _InterlockedAnd64((volatile signed __int64 *)(v10 + 24), 0x7FFFFFFFFFFFFFFFui64);
        __writecr8(v20);
        v20 = 17;
      }
    }
    v21 = v42;
LABEL_28:
    if( (a4 & 0x20) != 0 && !v21 )
      v20 = MiLockPageInline(v10);
LABEL_31:
    v22 = KeCopyPrivilegedPage((LARGE_INTEGER *)a1, ThawTimeout, a2);
    v11 = v22;
    if( v22 < 0 )
      KeBugCheckEx(0x1Au, 0x5150Aui64, a2, a1, v22);
    if( v20 != 17 )
    {
      _InterlockedAnd64((volatile signed __int64 *)(v10 + 24), 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v20);
    }
    if( (MiFlags & 0x40000) != 0
      && !v17
      && (*(_QWORD *)(v10 + 8) | 0x8000000000000000ui64) < (unsigned __int64)MmGetPteBase() + 0x4000000000i64 )
    {
      v11 = KeSetPagePrivilege(a1, (__int128 *)ThawTimeout, 4);
      if( v11 < 0 )
        KeBugCheckEx(0x1Au, 0x5150Dui64, a2, a1, 0i64);
    }
  }
  if( ((*(_QWORD *)(v35 + 40) >> 60) & 7) == 3 )
  {
    if( v17 )
      MiClearPfnImageVerified(v35, v34);
    if( (v8 & 4) == 0 && ((*(_QWORD *)(v10 + 40) >> 60) & 7) != 3 )
      MiMarkPfnVerified(v10, v34);
  }
  if( v11 < 0 )
  {
    v23 = *(unsigned __int8 *)(v35 + 34) >> 6;
    if( *(unsigned __int8 *)(v10 + 34) >> 6 != (_DWORD)v23 )
      MiChangePageAttribute(v10, v23, 0);
    if( !a3 )
    {
      a3 = &v38;
      if( (a4 & 1) == 0 || (MiCreatePteCopyList(2ui64, 2ui64, (__int64)&v38), !DWORD1(v38)) )
      {
        CurrentIrql = KeGetCurrentIrql();
        __writecr8(2ui64);
        BYTE8(v38) = CurrentIrql;
        HyperSpace = MiAllocateHyperSpace(2ui64);
        *(_QWORD *)&v38 = 0x200000000i64;
        v39 = (__int64)MmGetPteBase() + ((HyperSpace >> 9) & 0x7FFFFFFFF8i64);
        BYTE9(v38) = 1;
      }
    }
    PteFromCopyList = MiGetPteFromCopyList((UINT64 *)a3, a1, a2);
    KeCopyPage((PVOID)((__int64)(((_QWORD)PteFromCopyList << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16));
    v27 = ZeroPte;
    Pml4eBase = MmGetPml4eBase();
    PxeUserLimit = MmGetPxeUserLimit();
    if( PteFromCopyList >= (UINT64 *)Pml4eBase
      && PteFromCopyList <= (UINT64 *)PxeUserLimit
      && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
      && (ZeroPte & 1) != 0 )
    {
      v27 = ZeroPte | 0x8000000000000000ui64;
    }
    *PteFromCopyList = v27;
    v30 = ZeroPte;
    v31 = PteFromCopyList + 1;
    if( v31 >= (unsigned __int64 *)Pml4eBase
      && v31 <= (unsigned __int64 *)PxeUserLimit
      && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
      && (ZeroPte & 1) != 0 )
    {
      v30 = ZeroPte | 0x8000000000000000ui64;
    }
    *v31 = v30;
    if( a3 == &v38 )
    {
      v32 = *((_BYTE *)a3 + 8);
      if( v32 == 17 )
      {
        MiReleasePtes((INT64)&qword_140C4EC80, *((_QWORD *)a3 + 2), 2ui64);
      }
      else
      {
        v33 = *((_QWORD *)KeGetCurrentPrcb() + 4095);
        if( v33 )
        {
          *(_QWORD *)(v33 + 12344) = 0i64;
          v32 = *((_BYTE *)a3 + 8);
        }
        __writecr8(v32);
      }
    }
  }
}

Referenced by: