MiZeroLargePage

VOID __fastcall MiZeroLargePage(INT64 a1, UINT64 a2, INT64 a3){
  _MI_PFN_CACHE_ATTRIBUTE v3; 
  unsigned int v4; 
  __int64 v5; 
  unsigned __int64 v6; 
  __int64 *v7; 
  unsigned __int64 v8; 
  int ProtectionPfnCompatible; 
  unsigned __int64 v10; 
  INT64 v11; 
  INT64 v12; 
  UINT64 v13; 
  _QWORD *v14; 
  unsigned __int64 v15; 
  unsigned __int64 v16; 
  unsigned __int64 UltraMapping; 
  UINT64 v18; 
  _MMPTE *PteBase; 
  __int64 v20; 
  UINT64 ValidPte; 
  BOOL v22; 
  unsigned __int64 v23; 
  INT64 v24; 
  unsigned __int64 result[16]; 
  v3 = (int)a3;
  v4 = a2;
  v5 = (unsigned int)a2;
  v6 = (a1 - (__int64)MmGetPfnDb()) / 48;
  v7 = &MiLargePageSizes[(unsigned int)a2];
  v8 = *v7;
  if( v6 <= 0xFFFFFFFFFi64 && ((*((_QWORD *)MmGetPfnDb() + 6 * v6 + 5) >> 50) & 1) != 0 )
    ProtectionPfnCompatible = MiMakeProtectionPfnCompatible(4ui64, (_MMPFN *)a1);
  else
    ProtectionPfnCompatible = 4;
  v10 = 0i64;
  if( v4 <= 1
    && (memset((INT64)result, 0i64),
        (unsigned int)MiCreateUltraThreadContext((INT64)result, 0i64, 2 - (unsigned int)(v4 == 0))) )
  {
    UltraMapping = MiGetUltraMapping(&result[4 * v5], v4, *v7, 0);
    v18 = (UINT64)MmGetPdeBase() + ((UltraMapping >> 18) & 0x3FFFFFF8);
    if( !v4 )
    {
      PteBase = MmGetPteBase();
      v20 = 1i64;
      do
      {
        v18 = (UINT64)PteBase + ((v18 >> 9) & 0x7FFFFFFFF8i64);
        --v20;
      }
      while( v20 );
    }
    ValidPte = MiMakeValidPte(v18, v6, ProtectionPfnCompatible | 0xA4000000);
    v22 = MiPteInShadowRange(v18);
    if( v22 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (ValidPte & 1) != 0 )
      ValidPte |= 0x8000000000000000ui64;
    *(_QWORD *)v18 = ValidPte;
    KeZeroPages((PVOID)UltraMapping, v8 << 12);
    v23 = ZeroPte;
    if( v22 && (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0 && (ZeroPte & 1) != 0 )
      v23 = ZeroPte | 0x8000000000000000ui64;
    *(_QWORD *)v18 = v23;
    MiDeleteUltraThreadContext((INT64)result);
  }
  else
  {
    v11 = MiReservePtes((INT64)&qword_140C4EC80, (unsigned int)v8);
    v24 = v11;
    v12 = v11;
    if( v11 )
    {
      v13 = MiMakeValidPte(v11, v6, ProtectionPfnCompatible | 0xA0000000);
      if( v8 )
      {
        v14 = (_QWORD *)v12;
        v15 = v6 << 12;
        v16 = v8;
        do
        {
          v13 ^= (v13 ^ v15) & 0xFFFFFFFFF000i64;
          *v14 = v13;
          v15 += 4096i64;
          ++v14;
          --v16;
        }
        while( v16 );
        v12 = v24;
      }
      KeZeroPages((PVOID)(((v12 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16), v8 << 12);
      MiReleasePtes((INT64)&qword_140C4EC80, v12, (unsigned int)v8);
    }
    else if( v8 )
    {
      do
        MiZeroPhysicalPage(v6 + v10++, 0i64, v3);
      while( v10 < v8 );
    }
  }
}

Referenced by: