MiMapPagesToZero

INT64 __fastcall MiMapPagesToZero(INT64 a1, INT64 a2, UINT64 a3){
  unsigned int v3; 
  INT64 v4; 
  __int64 v6; 
  _MMPTE *PteBase; 
  UINT64 v8; 
  __int64 v9; 
  INT64 v10; 
  unsigned __int8 CurrentIrql; 
  int v12; 
  __int64 v14; 
  unsigned __int64 v15; 
  int v16; 
  char v17; 
  unsigned int v18; 
  unsigned __int64 v19; 
  unsigned __int64 v20; 
  _MMPTE *PteLimit; 
  unsigned __int64 LeafVa; 
  int v23; 
  unsigned __int64 v24; 
  int v25; 
  unsigned int v26; 
  __int64 v27; 
  __int64 v28; 
  unsigned __int64 v29; 
  UINT64 v30; 
  _MMPTE *Pml4eBase; 
  _MMPTE *PxeUserLimit; 
  unsigned __int64 v33; 
  unsigned __int64 UltraMapping; 
  __int64 v36; 
  unsigned int v37; 
  unsigned __int8 v38; 
  v37 = a3;
  v3 = a3;
  v4 = a1;
  if( (unsigned int)a3 >= 3 )
  {
    v6 = 1i64;
  }
  else
  {
    _mm_lfence();
    v6 = MiLargePageSizes[(unsigned int)a3];
  }
  v36 = v6;
  UltraMapping = MiGetUltraMapping((unsigned __int64 *)(32i64 * (unsigned int)a3 + a1 + 88), a3, v6, 0);
  PteBase = MmGetPteBase();
  v8 = (UINT64)PteBase + ((UltraMapping >> 9) & 0x7FFFFFFFF8i64);
  if( v3 <= 1 )
  {
    v9 = 2 - v3;
    do
    {
      v8 = (UINT64)PteBase + ((v8 >> 9) & 0x7FFFFFFFF8i64);
      --v9;
    }
    while( v9 );
  }
  v10 = (a2 - (__int64)MmGetPfnDb()) / 48;
  CurrentIrql = KeGetCurrentIrql();
  v38 = CurrentIrql;
  __writecr8(2ui64);
  v12 = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)(a2 + 24), 0x3Fui64) )
  {
    do
    {
      ++v12;
      _mm_pause();
    }
    while( *(__int64 *)(a2 + 24) < 0 );
  }
  if( *(_BYTE *)(v4 + 69) == 1 )
  {
    MiRemoveFaultNode(v4);
    _InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(CurrentIrql);
    ++dword_140C2A070;
    return 0i64;
  }
  v14 = *(unsigned __int8 *)(a2 + 34) >> 6;
  if( v36 != 1 )
    goto LABEL_19;
  if( (_DWORD)v14 && (_DWORD)v14 != 2 )
  {
    if( (*(_BYTE *)(a2 + 34) & 0xC0) == 0xC0 )
      MiFinalizePageAttribute((_MMPFN *)a2, MiCached, 1ui64);
    goto LABEL_19;
  }
  v15 = 0x140000000ui64;
  if( dword_140C4DCDC[4 * v14] == 1 )
  {
    MiChangePageAttribute(a2, 1i64, 1);
LABEL_19:
    v15 = 0x140000000ui64;
  }
  v16 = 4;
  v17 = *(_BYTE *)(a2 + 34) >> 6;
  if( v17 )
  {
    if( v17 == 2 )
      v16 = 28;
  }
  else
  {
    v16 = 12;
  }
  v18 = v16 | 0xA0000000;
  if( v3 <= 1 )
    v18 = v16 | 0xA4000000;
  v19 = (unsigned __int64)MmGetPteBase();
  v20 = ((v10 & 0xFFFFFFFFFi64) << 12) | MmProtectToPteMask[v18 & 0x1F] & 0xFFFF000000000E7Fui64 | 0x21;
  if( v8 < v19 )
    goto LABEL_49;
  PteLimit = MmGetPteLimit();
  if( v8 > (unsigned __int64)PteLimit )
    goto LABEL_49;
  LeafVa = (__int64)((v8 << 25) - (v19 << 25)) >> 16;
  if( v8 >= (unsigned __int64)MmGetPdeBase() && v8 <= (unsigned __int64)MmGetPdeLimit() )
  {
    if( (_MMPTE *)v8 == MmGetPxeSelfRef() )
    {
      v20 |= 0x8000000000000000ui64;
    }
    else if( (v18 & 0x4000000) == 0 )
    {
      v20 &= ~0x8000000000000000ui64;
    }
    v23 = MiUserPdeOrAbove(v8);
    PteLimit = MmGetPteLimit();
    v15 = 0x140000000ui64;
    v19 = (unsigned __int64)MmGetPteBase();
    if( v23 )
      v20 |= 4ui64;
  }
  v24 = v20;
  v20 |= 4ui64;
  if( v8 > v19 + 0x3FFFFFFF78i64 )
    v20 = v24;
  if( (v18 & 0x4000000) != 0 )
  {
    LeafVa = MiGetLeafVa(LeafVa);
    v19 = (unsigned __int64)MmGetPteBase();
  }
  if( LeafVa >= 0xFFFF800000000000ui64 )
  {
    if( *(_BYTE *)(((LeafVa >> 39) & 0x1FF) - 256 + v15 + 12908296) == 1
      || LeafVa >= v19 && LeafVa <= (unsigned __int64)PteLimit )
    {
      goto LABEL_50;
    }
    if( LeafVa < qword_140C4F878 || (v25 = HIBYTE(word_140C4DD48), LeafVa > qword_140C4E0A8) )
      v25 = (unsigned __int8)word_140C4DD48;
  }
  else
  {
    v25 = HIBYTE(word_140C4DD48);
  }
  if( v25 )
LABEL_49:
    v20 |= 0x100ui64;
LABEL_50:
  v26 = v37;
  v27 = v20 ^ ((unsigned __int16)v20 ^ (unsigned __int16)((unsigned __int8)word_140C4DD48 << 8)) & 0x100 | 0x42;
  v28 = v20 ^ ((unsigned __int16)v20 ^ (unsigned __int16)((unsigned __int8)word_140C4DD48 << 8)) & 0x100 | 0xC2;
  if( (v18 & 0x4000000) == 0 )
    v28 = v27;
  v29 = v28 & 0xF0FFFFFFFFFFFFFFui64 | 0xA00000000000000i64;
  if( v37 > 1 )
  {
    v30 = 8 * v36 + v8;
    if( v8 < v30 )
    {
      Pml4eBase = MmGetPml4eBase();
      PxeUserLimit = MmGetPxeUserLimit();
      do
      {
        v33 = v29;
        if( v8 >= (unsigned __int64)Pml4eBase
          && v8 <= (unsigned __int64)PxeUserLimit
          && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
          && (v29 & 1) != 0 )
        {
          v33 = v29 | 0x8000000000000000ui64;
        }
        *(_QWORD *)v8 = v33;
        v8 += 8i64;
        v29 ^= (v29 ^ (v29 + 4096)) & 0xFFFFFFFFF000i64;
      }
      while( v8 < v30 );
      CurrentIrql = v38;
      v4 = a1;
      v26 = v37;
    }
    v8 -= 8 * v36;
  }
  else
  {
    *(_QWORD *)v8 = v29;
  }
  *(_QWORD *)(v4 + 32) = v8;
  *(_QWORD *)(v4 + 40) = UltraMapping;
  *(_QWORD *)(v4 + 48) = UltraMapping + (v36 << 12) - 1;
  *(_DWORD *)(v4 + 64) = v26;
  *(_QWORD *)(v4 + 72) = a2;
  _InterlockedAnd64((volatile signed __int64 *)(a2 + 24), 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(CurrentIrql);
  return 1i64;
}

Referenced by: