MiCheckSlabPage
INT64 __fastcall MiCheckSlabPage(INT64 rcx0, INT64 a2, CHAR a3){
unsigned int v3;
__int64 v4;
INT64 v5;
INT64 SlabAllocator;
volatile LONG *v7;
KIRQL v8;
INT64 v9;
unsigned int v10;
unsigned __int64 v11;
int v12;
int v13;
INT64 v14;
unsigned __int64 a1;
v3 = a2;
v4 = (unsigned __int128)((rcx0 - (__int64)MmGetPfnDb()) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64;
v5 = *(_QWORD *)(qword_140C4E388 + 8 * ((*(_QWORD *)(rcx0 + 40) >> 39) & 0x3FFi64));
a1 = ((unsigned __int64)v4 >> 63) + (v4 >> 3);
SlabAllocator = MiGetSlabAllocator(v5, v3, a3);
v7 = (volatile LONG *)(SlabAllocator + 16);
v8 = ExAcquireSpinLockShared((PEX_SPIN_LOCK)(SlabAllocator + 16));
v9 = *(_QWORD *)SlabAllocator;
v10 = 0;
v11 = v8;
if( (*(_BYTE *)(SlabAllocator + 8) & 1) != 0 )
{
if( v9 )
v9 ^= SlabAllocator;
else
v9 = 0i64;
}
v12 = *(_BYTE *)(SlabAllocator + 8) & 1;
while( v9 )
{
v13 = MiCompareSlabEntry(&a1, v9);
if( v13 >= 0 )
{
if( v13 <= 0 )
break;
v14 = *(_QWORD *)(v9 + 8);
}
else
{
v14 = *(_QWORD *)v9;
}
if( v12 && v14 )
v9 ^= v14;
else
v9 = v14;
}
ExReleaseSpinLockSharedFromDpcLevel(v7);
__writecr8(v11);
LOBYTE(v10) = v9 != 0;
return v10;
}Referenced by:
MiFinalizeImageHeaderPage
MiMakeDriverPagesPrivate
MiWalkEntireImage