MiCapturePfnVm

_MMSUPPORT_INSTANCE *__stdcall MiCapturePfnVm(
        _MI_PAGE_COMBINING_SUPPORT *Pcs,
        _MMPFN *LeafPfn,
        VOID **ReferencedObject,
        _MMPTE **CapturedPte,
        UINT64 *CapturedProtection){
  unsigned int v6; 
  _QWORD *v7; 
  int *v9; 
  _MI_PARTITION *Partition; 
  unsigned __int8 CurrentIrql; 
  _MI_COMBINE_CANDIDATE v12; 
  int v13; 
  _MMPFN *TopLevelPfn; 
  _EPROCESS *v15; 
  _MMSUPPORT_INSTANCE *p_Instance; 
  unsigned int v17; 
  __int64 v18; 
  UINT64 v20; 
  int v21; 
  int CapturedProtectiona; 
  UINT64 SpinCount; 
  int *v24; 
  _QWORD *v25; 

  v6 = (unsigned int)ReferencedObject;
  v7 = (_QWORD *)SpinCount;
  v9 = v24;
  Partition = Pcs->Partition;
  *CapturedProtection = 0i64;
  *v7 = 0i64;
  *v9 = 24;
  if( MiHashIsCommon((_MI_COMBINE_CONTROL_BLOCK *)Pcs, (UINT64)CapturedPte) )
  {
    CapturedProtectiona = 1;
    *v25 = *(&stru_140C4DB30 + 236);
  }
  else
  {
    CapturedProtectiona = 0;
  }
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)&LeafPfn->u2, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( LeafPfn->u2._bf_0 < 0 );
  }
  v12 = MiCombineCandidate((_MI_PAGE_COMBINING_SUPPORT *)Partition, (_MMPFN *)v6);
  if( v12 == MiCombineNone )
  {
    _InterlockedAnd64(&LeafPfn->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(CurrentIrql);
    return 0i64;
  }
  v13 = (*((_DWORD *)&LeafPfn->3 + 4) >> 5) & 0x1F;
  *v7 = LeafPfn->PteLong | 0x8000000000000000ui64;
  *v9 = v13;
  if( v12 == MiCombineUser )
  {
    TopLevelPfn = MiGetTopLevelPfn(LeafPfn, (UINT64 *)0x8000000000000000i64);
    v15 = (_EPROCESS *)(((unsigned __int64)TopLevelPfn->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >> 13) & 0x7FFFFFFFFFF0i64 | 0xFFFF800000000000ui64);
    p_Instance = &v15->Vm.Instance;
    if( MiIsStoreProcess(v15) )
      p_Instance = 0i64;
    if( (v15->MitigationFlags2 & 0x1000) != 0 && !CapturedProtectiona )
      p_Instance = 0i64;
    if( ObReferenceObjectSafeWithTag((INT64)v15, 1953261124i64) )
      *CapturedProtection = (UINT64)v15;
    else
      p_Instance = 0i64;
    if( TopLevelPfn != LeafPfn )
      _InterlockedAnd64(&TopLevelPfn->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    goto LABEL_13;
  }
  if( !CapturedProtectiona )
  {
LABEL_23:
    p_Instance = 0i64;
    goto LABEL_13;
  }
  if( v12 != MiCombinePagedPool )
  {
    LODWORD(v20) = MiReferenceOwningSession((_XSTATE_CONFIGURATION *)LeafPfn);
    if( v20 )
    {
      p_Instance = (_MMSUPPORT_INSTANCE *)(*(_QWORD *)(v20 + 1368) + 256i64);
      *CapturedProtection = v20;
      goto LABEL_13;
    }
    goto LABEL_23;
  }
  p_Instance = MiGetAnyMultiplexedVm(MiWorkingSetTypePagedPool, (VOID *)0x8000000000000000i64);
LABEL_13:
  _InterlockedAnd64(&LeafPfn->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(CurrentIrql);
  if( p_Instance )
  {
    v17 = CapturedProtectiona;
    if( !CapturedProtectiona )
    {
      LODWORD(v18) = MiGetCombineDomain((unsigned int)v12, (INT64)p_Instance);
      *v25 = v18;
      v17 = 0;
    }
    if( v12 == MiCombineUser && *(_QWORD *)(*CapturedProtection + 2288) )
    {
      LOBYTE(v21) = VmCheckPageCombine(*CapturedProtection, v17);
      if( !v21 )
        return 0i64;
    }
  }
  return p_Instance;
}

Referenced by: