MiDeleteBootRange

VOID __stdcall MiDeleteBootRange(_MMPTE *PointerPte, UINT64 PageCount, UINT64 NonPaged){
  _MMPTE *v3; 
  UINT64 v4; 
  _MMPTE *PteBase; 
  UINT64 v6; 
  char *v7; 
  char *v8; 
  _MMSUPPORT_SHARED *SharedVm; 
  UINT8 v10; 
  UINT8 v11; 
  UINT64 v12; 
  _MMPFN *PfnDb; 
  unsigned __int64 v14; 
  _MMPFN *v15; 
  UINT8 v16; 
  _MMSUPPORT_INSTANCE *v17; 
  _ETHREAD *CurrentThread; 
  _MMSUPPORT_SHARED *v19; 
  UINT8 v20; 
  UINT8 v21; 
  UINT64 v22; 
  unsigned __int64 v23; 
  _MMPFN *v24; 
  struct _KPRCB *CurrentPrcb; 
  unsigned __int64 v26; 
  __int64 CachedResidentAvailable; 
  bool v28; 
  signed __int32 v29; 
  UINT64 v30; 
  __int64 v31; 
  __int64 v32; 
  unsigned __int64 v33; 
  unsigned __int64 i; 
  __int16 v35; 
  INT64 v36; 
  _MMPTE *PdeBase; 
  __int64 v38; 
  unsigned __int64 v39; 
  unsigned __int64 v40; 
  char *v41; 
  _MI_TB_FLUSH_LIST *v42; 
  _MMSUPPORT_SHARED *v43; 
  UINT8 v44; 
  UINT64 Flags; 
  _MMSUPPORT_INSTANCE *Vm; 
  char *v47; 
  _MI_DELETE_VA_INFO DeleteInfo; 
  __int128 v49; 
  __int128 v50; 
  UINT64 SpinCount; 
  UINT64 v54; 

  LODWORD(SpinCount) = NonPaged;
  v3 = PointerPte;
  v4 = PageCount;
  PteBase = MmGetPteBase();
  DeleteInfo = 0i64;
  v49 = 0i64;
  v50 = 0i64;
  v6 = (UINT64)PteBase + (((unsigned __int64)PointerPte >> 9) & 0x7FFFFFFFF8i64);
  v7 = (char *)v6;
  v8 = (char *)PteBase + (((unsigned __int64)&PointerPte[v4 - 1] >> 9) & 0x7FFFFFFFF8i64);
  v47 = v8;
  Vm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, PteBase);
  SharedVm = MiGetSharedVm(Vm);
  v10 = ExAcquireSpinLockExclusive((INT64 *)&SharedVm->WorkingSetLock);
  SharedVm->GoodCitizenWaiting = 0;
  v11 = v10;
  if( v6 <= (unsigned __int64)v8 )
  {
    v12 = v6;
    PfnDb = MmGetPfnDb();
    do
    {
      v14 = *(_QWORD *)v7;
      MiPteInShadowRange(v12);
      v15 = &PfnDb[(v14 >> 12) & 0xFFFFFFFFFi64];
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v15->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( v15->u2._bf_0 < 0 );
      }
      v15->u2._bf_0 ^= ((v15->u2._bf_0 + 1) ^ v15->u2._bf_0) & 0x3FFFFFFFFFFFFFFFi64;
      _InterlockedAnd64(&v15->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      v7 += 8;
      v12 = (UINT64)v7;
    }
    while( v7 <= v8 );
    v4 = PageCount;
    v3 = PointerPte;
  }
  v16 = v11;
  v17 = Vm;
  MiUnlockWorkingSetExclusive(Vm, v16);
  LODWORD(Flags) = 1;
  MiDeleteSystemPagableVm(Vm, 0i64, v3, v4, Flags, &DeleteInfo);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireResourceSharedLite((UINT64)&PsLoadedModuleResource, 1);
  v19 = MiGetSharedVm(Vm);
  v20 = ExAcquireSpinLockExclusive((INT64 *)&v19->WorkingSetLock);
  v19->GoodCitizenWaiting = 0;
  v21 = v20;
  if( v6 <= (unsigned __int64)v47 )
  {
    v22 = v6;
    do
    {
      v23 = *(_QWORD *)v6;
      MiPteInShadowRange(v22);
      v24 = &MmGetPfnDb()[(v23 >> 12) & 0xFFFFFFFFFi64];
      LODWORD(v54) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v24->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&v54);
        while( v24->u2._bf_0 < 0 );
      }
      v24->u2._bf_0 ^= ((v24->u2._bf_0 - 1) ^ v24->u2._bf_0) & 0x3FFFFFFFFFFFFFFFi64;
      _InterlockedAnd64(&v24->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
      if( (v24->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
      {
        v31 = (_QWORD)MmGetPteBase() << 25;
        v32 = (__int64)((v6 << 25) - v31) >> 16;
        v33 = v32;
        for( i = v32 + 4096; v33 < i; v33 += 8i64 )
        {
          v35 = MI_READ_PTE_LOCK_FREE(v33);
          if( (v35 & 0xC01) != 0 || (v35 & 0x3E0) != 0 && (v35 & 0x3E0) != 768i64 )
            break;
        }
        if( v33 == i )
        {
          v36 = PsLoadedModuleList;
          PdeBase = MmGetPdeBase();
          v38 = ((v32 << 25) - v31) >> 16;
          while( 1 )
          {
            v39 = *(_QWORD *)(v36 + 48);
            v40 = v39
                + (((unsigned int)dword_140C4C9F0 + 4095i64) & 0xFFFFFFFFFFFFF000ui64)
                + (unsigned int)(*(_DWORD *)(v36 + 64) - 1);
            if( v39 != PsNtosImageBase && (PVOID)v39 != PsHalImageBase )
              v40 += (unsigned __int64)(unsigned int)dword_140C4C98C << 12;
            v41 = (char *)PdeBase + ((v40 >> 18) & 0x3FFFFFF8);
            if( v6 >= (unsigned __int64)PdeBase + ((v39 >> 18) & 0x3FFFFFF8) && v6 <= (unsigned __int64)v41 )
              break;
            v36 = *(_QWORD *)v36;
            if( (INT64 *)v36 == &PsLoadedModuleList )
              goto LABEL_30;
          }
          v36 = 0i64;
LABEL_30:
          v17 = Vm;
          if( v36 )
          {
            MiUnlockWorkingSetExclusive(Vm, v21);
            MiReturnSystemVa((VOID *)v38, (VOID *)(v38 + 0x200000), MiVaDriverImages, v42);
            v43 = MiGetSharedVm(Vm);
            v44 = ExAcquireSpinLockExclusive((INT64 *)&v43->WorkingSetLock);
            v43->GoodCitizenWaiting = 0;
            v21 = v44;
          }
        }
        else
        {
          v17 = Vm;
        }
      }
      v6 += 8i64;
      v22 = v6;
    }
    while( v6 <= (unsigned __int64)v47 );
    v4 = PageCount;
  }
  MiUnlockWorkingSetExclusive(v17, v21);
  ExReleaseResourceLite(&PsLoadedModuleResource);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  CurrentPrcb = KeGetCurrentPrcb();
  v26 = v4;
  CachedResidentAvailable = (int)CurrentPrcb->CachedResidentAvailable;
  if( (_DWORD)CachedResidentAvailable != -1 )
  {
    if( v4 + CachedResidentAvailable <= 0x100 )
    {
      do
      {
        if( v4 >= 0x80000 )
          break;
        v29 = _InterlockedCompareExchange(
                (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                v4 + CachedResidentAvailable,
                CachedResidentAvailable);
        v28 = (_DWORD)CachedResidentAvailable == v29;
        LODWORD(CachedResidentAvailable) = v29;
        if( v28 )
          goto LABEL_18;
      }
      while( v29 != -1 && v4 + v29 <= 0x100 );
    }
    if( (int)CachedResidentAvailable > 192
      && (_DWORD)CachedResidentAvailable != -1
      && (_DWORD)CachedResidentAvailable == _InterlockedCompareExchange(
                                              (volatile signed __int32 *)&CurrentPrcb->CachedResidentAvailable,
                                              192,
                                              CachedResidentAvailable) )
    {
      v26 = v4 + (int)CachedResidentAvailable - 192;
    }
  }
  if( v26 )
    _InterlockedExchangeAdd64((_QWORD *)&stru_140C50B28 + 883, v26);
LABEL_18:
  v30 = v4 - *(_QWORD *)&DeleteInfo.ReducedCommitClonePages;
  MiReturnCommit(&Irp, v30);
  *(&stru_140C4DB30 + 568) -= v30;
}

Referenced by: