MmReadProcessPageTables

NTSTATUS __stdcall MmReadProcessPageTables(_KPRCB *TargetPrcb){
  __int64 v1; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v3; 
  NTSTATUS result; 
  unsigned int v5; 
  unsigned __int64 v6; 
  volatile __int64 *v7; 
  __int64 v8; 
  PHYSICAL_MEMORY_DESCRIPTOR *v9; 
  _MMPFN *PfnDb; 
  _MMPTE *PteLimit; 
  unsigned __int64 BasePage; 
  _MMPFN *v13; 
  _MMPFN *v14; 
  unsigned __int64 v15; 
  unsigned __int64 PteBase; 
  unsigned __int64 v17; 
  unsigned __int64 EntireField; 
  unsigned __int64 v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 

  LODWORD(v1) = MiMakeValidPte(0i64, 0i64, 2684354564i64);
  CurrentPrcb = KeGetCurrentPrcb();
  v3 = v1;
  __wbinvd();
  result = ExTryAcquireSpinLockSharedAtDpcLevel((INT64 *)&stru_140C50B28 + 12);
  v5 = 0;
  if( result )
  {
    v6 = (unsigned __int64)CurrentPrcb->HyperPte & 0xFFFFFFFFFFFFF000ui64;
    v7 = (volatile __int64 *)((char *)MmGetPteBase() + ((v6 >> 9) & 0x7FFFFFFFF8i64));
    v8 = _InterlockedExchange64(v7, ZeroPte.u.Hard._bf_0);
    KeFlushSingleCurrentTb((VOID *)v6);
    v9 = MmPhysicalMemoryBlock;
    if( MmPhysicalMemoryBlock->NumberOfRuns )
    {
      PfnDb = MmGetPfnDb();
      PteLimit = MmGetPteLimit();
      do
      {
        BasePage = v9->Run[v5].BasePage;
        v13 = &PfnDb[BasePage];
        v14 = &PfnDb[BasePage + v9->Run[v5].PageCount];
        if( v13 < v14 )
        {
          do
          {
            if( (*(_BYTE *)(&v13->u3 + 1) & 7) == 6 )
            {
              v15 = v13->PteLong | 0x8000000000000000ui64;
              PteBase = (unsigned __int64)MmGetPteBase();
              if( v15 >= PteBase && v15 <= (unsigned __int64)PteLimit )
              {
                v17 = (__int64)((v15 << 25) - (PteBase << 25)) >> 16;
                if( v17 >= PteBase && v17 <= (unsigned __int64)PteLimit )
                {
                  EntireField = v13->u4.EntireField;
                  if( ((EntireField >> 60) & 7) != 1
                    && (EntireField & 0x1000000000i64) == 0
                    && (EntireField & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64
                    && (*(_BYTE *)(&v13->u3 + 1) & 0xC0) == 64 )
                  {
                    v3 ^= (v3 ^ ((v13 - MmGetPfnDb()) << 12)) & 0xFFFFFFFFF000i64;
                    _InterlockedExchange64(v7, v3);
                    KeFlushSingleCurrentTb((VOID *)v6);
                    v19 = v6;
                    v20 = 64i64;
                    do
                    {
                      v19 += 64i64;
                      --v20;
                    }
                    while( v20 );
                    v21 = KiCacheErrataMonitor;
                    v22 = CurrentPrcb->Number + 16i64;
                    CurrentPrcb->ClockKeepAlive = 1;
                    _InterlockedExchange64((volatile __int64 *)(v21 + 16 * v22), -1i64);
                    if( (*(_QWORD *)(v21 + 16 * (TargetPrcb->Number + 16i64)) & CurrentPrcb->GroupSetMember) != 0 )
                      goto LABEL_21;
                    PteLimit = MmGetPteLimit();
                  }
                }
              }
            }
            ++v13;
          }
          while( v13 < v14 );
          PfnDb = MmGetPfnDb();
        }
        v9 = MmPhysicalMemoryBlock;
        ++v5;
      }
      while( v5 < MmPhysicalMemoryBlock->NumberOfRuns );
    }
LABEL_21:
    _InterlockedExchange64(v7, v8);
    KeFlushSingleCurrentTb((VOID *)v6);
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)&stru_140C50B28 + 24);
    return 1;
  }
  return result;
}

Referenced by: