MiDeleteValidSystemPage

VOID __stdcall MiDeleteValidSystemPage(_MMPTE *PointerPte, UINT64 Flags, _MI_DELETE_VA_INFO *DeleteInfo){
  wchar_t *v3; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v4; 
  __int64 v5; 
  _MMPTE *Pml4eBase; 
  UINT64 PxeUserLimit; 
  __int64 bf_0_high; 
  _MI_PARTITION *v10; 
  _MMPFN *PfnDb; 
  __int64 v12; 
  unsigned __int64 EntireField; 
  INT64 v14; 
  int v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  __int64 v19; 
  int v20; 
  __int64 v21; 
  __int64 v22; 
  _MMPFN *v23; 
  int v24; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v25; 
  __int64 v26; 
  __int64 v27; 
  char v28; 
  unsigned __int64 v29; 
  int v30; 
  unsigned int v31; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v32; 
  INT64 v33; 
  int v34; 
  unsigned __int64 Long; 
  __int64 v36; 
  __int64 v37; 
  _MI_PAGE_DELETE_RESULT v38; 
  __int64 bf_0; 
  __int64 v40; 
  UINT64 v41; 
  __int64 v42; 
  _MI_PARTITION *Partition; 
  unsigned __int64 v44; 
  UINT64 SpinCount; 
  int v47; 
  wchar_t *v48; 

  v48 = v3;
  v47 = (int)DeleteInfo;
  v4.Long = ZeroPte.u.Long;
  v5 = *(_QWORD *)Flags;
  v44 = 0i64;
  Pml4eBase = MmGetPml4eBase();
  PxeUserLimit = (UINT64)MmGetPxeUserLimit();
  if( Flags >= (unsigned __int64)Pml4eBase && Flags <= PxeUserLimit )
    PxeUserLimit = (UINT64)MmGetPxeUserLimit();
  bf_0_high = HIWORD(PointerPte[21].u.TimeStamp._bf_0);
  v42 = v5;
  v10 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * bf_0_high);
  if( &v42 < (__int64 *)Pml4eBase || (unsigned __int64)&v42 > PxeUserLimit )
    PxeUserLimit = v5;
  PfnDb = MmGetPfnDb();
  v12 = (PxeUserLimit >> 12) & 0xFFFFFFFFFi64;
  EntireField = PfnDb[v12].u4.EntireField;
  v14 = (INT64)&PfnDb[v12];
  Partition = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * ((EntireField >> 39) & 0x3FF));
  LOBYTE(v15) = MI_PFN_IS_PROTO((_UNICODE_STRING *)&PfnDb[v12], (_UNICODE_STRING *)EntireField, (UINT8)PfnDb, v3);
  if( v15 )
  {
    if( (v16 & 0x1000000000i64) == 0 )
    {
      v21 = *(_QWORD *)(v14 + 8);
      if( v21 > 0 )
        v44 = v21 | 0x8000000000000000ui64;
    }
    LODWORD(v22) = MiGetContainingPageTable(Flags);
    v23 = &MmGetPfnDb()[v22];
    LODWORD(SpinCount) = v24;
    while( _interlockedbittestandset64((volatile signed __int32 *)(v14 + 24), 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&SpinCount);
      while( *(__int64 *)(v14 + 24) < 0 );
    }
    if( (v5 & 0x42) != 0 )
    {
      MiCaptureDirtyBitToPfn();
      v4.Long = v25.Long;
    }
    v26 = *(_QWORD *)(v14 + 16);
    if( (v26 & 0x400) == 0 || (v5 & 0x200) != 0 )
    {
      v27 = (__int64)v48;
      v28 = v47;
      ++*((_QWORD *)v48 + 3);
    }
    else
    {
      if( *(&stru_140C4DB30 + 42) && (v26 & 0x10) == 0 )
        v26 &= ~*(&stru_140C4DB30 + 42);
      v27 = (__int64)v48;
      v28 = v47;
      if( (*(_DWORD *)(*(_QWORD *)(v26 >> 16) + 56i64) & 0x820) == 2080 )
        ++*((_QWORD *)v48 + 3);
    }
LABEL_45:
    if( (v28 & 0x10) != 0 )
      *(_BYTE *)(v14 + 35) &= ~8u;
    Long = ZeroPte.u.Long;
    if( Flags >= (unsigned __int64)MmGetPml4eBase()
      && Flags <= (unsigned __int64)MmGetPxeUserLimit()
      && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
      && (ZeroPte.u.Long & 1) != 0 )
    {
      Long = ZeroPte.u.Long | 0x8000000000000000ui64;
    }
    *(_QWORD *)Flags = Long;
    if( (*(_BYTE *)(v14 + 34) & 7) != 6 )
      MiBadShareCount();
    v36 = *(_QWORD *)(v14 + 24);
    v37 = (v36 & 0x3FFFFFFFFFFFFFFFi64) - 1;
    *(_QWORD *)(v14 + 24) = v36 ^ (v37 ^ v36) & 0x3FFFFFFFFFFFFFFFi64;
    if( (v36 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
      v38 = MiPfnShareCountIsZero((_MMPFN *)v14, (_MMPFN *)v37);
    else
      v38 = PageStillShared;
    _InterlockedAnd64((volatile signed __int64 *)(v14 + 24), 0x7FFFFFFFFFFFFFFFui64);
    HIDWORD(v41) = 0;
    while( _interlockedbittestandset64((volatile signed __int32 *)&v23->u2, 0x3Fui64) )
    {
      do
        KeYieldProcessorEx((UINT64 *)((char *)&v41 + 4));
      while( v23->u2._bf_0 < 0 );
    }
    if( (*(_BYTE *)(&v23->u3 + 1) & 7) != 6 )
      MiBadShareCount();
    bf_0 = v23->u2._bf_0;
    v40 = (bf_0 & 0x3FFFFFFFFFFFFFFFi64) - 1;
    v23->u2._bf_0 = bf_0 ^ (v40 ^ bf_0) & 0x3FFFFFFFFFFFFFFFi64;
    if( (bf_0 & 0x3FFFFFFFFFFFFFFFi64) == 1 )
      MiPfnShareCountIsZero(v23, (_MMPFN *)v40);
    _InterlockedAnd64(&v23->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    if( v4.Long )
      MiReleasePageFileInfo(Partition, (_MMPTE)v4.Long, 1ui64);
    if( v44 )
      v38 = MiDecrementCombinedPte(PointerPte);
    if( v38 == PageStillReferenced )
      ++*(_QWORD *)(v27 + 8);
    return;
  }
  if( v14 != *(&stru_140C4DB30 + 494) )
  {
    if( (*(_QWORD *)(v14 + 8) | 0x8000000000000000ui64) != Flags )
      KeBugCheckEx(0x1Au, (PVOID)0x404, (PVOID)Flags, (PVOID)v5, *(PVOID *)(v14 + 8));
    ++*(_QWORD *)(v18 + 24);
    v23 = (_MMPFN *)(v17 + 48 * (v19 & v16));
    LODWORD(v41) = v20;
    while( _interlockedbittestandset64((volatile signed __int32 *)(v14 + 24), 0x3Fui64) )
    {
      do
        KeYieldProcessorEx(&v41);
      while( *(__int64 *)(v14 + 24) < 0 );
    }
    *(_QWORD *)(v14 + 24) |= 0x4000000000000000ui64;
    if( ((*(_QWORD *)(v14 + 40) >> 60) & 7) == 2 )
    {
      MiCaptureDirtyBitToPfn();
      v31 = *(unsigned __int16 *)(v14 + 32);
      v4.Long = v32.Long;
      if( (!(_WORD)v31 || v31 > 2 && (v31 != 3 || (*(_BYTE *)(v14 + 34) & 8) == 0)) && Partition != v10 )
        KeBugCheckEx(0x1Au, (PVOID)0x406, (PVOID)Flags, (PVOID)(v12 * 48 / 48), (PVOID)*(unsigned __int16 *)(v14 + 32));
      *(_QWORD *)(v14 + 40) &= 0x8FFFFFFFFFFFFFFFui64;
    }
    v28 = v47;
    if( (v47 & 4) != 0 )
    {
      MiIsPfnSystemCharged(v14);
      if( v34 )
      {
        MiDriverPageIsDangling(v33);
        *(_BYTE *)(v14 + 35) &= ~0x20u;
      }
    }
    v27 = (__int64)v48;
    goto LABEL_45;
  }
  v29 = ZeroPte.u.Long;
  LOBYTE(v30) = MiPteInShadowRange(Flags);
  if( v30 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
    v29 = ZeroPte.u.Long | 0x8000000000000000ui64;
  *(_QWORD *)Flags = v29;
}

Referenced by: