MiCombineCandidate

_MI_COMBINE_CANDIDATE __stdcall MiCombineCandidate(_MI_PAGE_COMBINING_SUPPORT *Pcs, _MMPFN *InputPfn){
  __int64 v2; 
  char v3; 
  __int128 v4; 
  __int128 v5; 
  unsigned __int64 Buffer; 
  __int64 v7; 
  int v8; 
  unsigned __int64 v9; 
  __int64 v10; 
  unsigned __int64 PteBase; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  int v15; 
  _MI_COMBINE_CANDIDATE v16; 
  __int64 v17; 
  int v18; 
  unsigned __int64 v20; 
  _UNICODE_STRING antNameA; 
  __int128 v22; 
  __int128 v23; 
  __int64 v24; 

  v3 = (char)InputPfn;
  v4 = *(_OWORD *)(v2 + 16);
  antNameA = *(_UNICODE_STRING *)v2;
  v5 = *(_OWORD *)(v2 + 32);
  v22 = v4;
  v23 = v5;
  if( (BYTE2(v5) & 7u) <= 1 )
    return 0;
  Buffer = (unsigned __int64)antNameA.Buffer;
  v7 = (*((_QWORD *)&v23 + 1) >> 39) & 0x3FFi64;
  if( *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v7) != Pcs->Partition && (v3 & 1) == 0 )
    return 0;
  LOBYTE(v8) = MI_PFN_IS_PROTO(&antNameA, (_UNICODE_STRING *)v7, BYTE8(v23), (PWCHAR)v2);
  if( v8 )
    return 0;
  if( (v9 & 0x1000000000i64) != 0 )
    return 0;
  if( (BYTE3(v23) & 8) != 0 )
    return 0;
  PteBase = (unsigned __int64)MmGetPteBase();
  if( Buffer < PteBase
    || Buffer > (unsigned __int64)MmGetPteLimit()
    || (*((_QWORD *)&v22 + 1) & 0x4000000000000000i64) != 0
    || ((v9 >> 60) & 7) == 4
    || (Buffer | 0x8000000000000000ui64) <= PteBase + 0x3FFFFFFF78i64
    && (Buffer | 0x8000000000000000ui64) >= PteBase
    && (BYTE3(v23) & 0x20) != 0 )
  {
    return 0;
  }
  if( *(&stru_140C50B28 + 4726)
    && _bittest64(*(&stru_140C50B28 + 756), (unsigned __int64)((v10 - (__int64)MmGetPfnDb()) / 48) >> 9) )
  {
    return 0;
  }
  v12 = v22;
  v24 = v22;
  if( (v22 & 1) != 0
    || (_QWORD)v22 && *(&stru_140C4DB30 + 42) && (*(&stru_140C4DB30 + 42) & (unsigned __int64)v22) == 0 )
  {
    return 0;
  }
  v13 = ((unsigned __int64)v22 >> 5) & 0x1F;
  if( (_DWORD)v13 == 24
    || (_DWORD)v13 == 31
    || (((unsigned __int64)v22 >> 5) & 0x18) == 16
    || (unsigned int)v13 >= 0x1E
    || MiGetPagePrivilege((ULONG_PTR)&antNameA, 0i64, 0i64) )
  {
    return 0;
  }
  v14 = (__int64)((Buffer << 25) - (PteBase << 25)) >> 16;
  if( v14 >= 0xFFFF800000000000ui64 )
    v15 = *((unsigned __int8 *)&stru_140C4DB30 + ((v14 >> 39) & 0x1FF) + 6872);
  else
    v15 = 0;
  if( Buffer > PteBase + 0x3FFFFFFF78i64 )
  {
    if( v15 == 6 )
    {
      v16 = MiCombinePagedPool;
    }
    else
    {
      if( v15 != 1 || MiIsSessionMetadata((VOID *)v14) )
        return 0;
      v16 = MiCombineSessionSpace;
    }
  }
  else
  {
    v16 = MiCombineUser;
  }
  v17 = BYTE2(v23) & 7;
  if( (unsigned __int8)(v17 - 2) > 1u || (_WORD)v23 )
  {
    if( (_BYTE)v17 != 6
      || (antNameA.Length & 1) == 0
      || (*((_QWORD *)&v23 + 1) & 0xFFFFFFFFFi64) == 0xFFFFFFFFDi64
      || (_WORD)v23 != 1
      || (*((_QWORD *)&v22 + 1) & 0x3FFFFFFFFFFFFFFFi64) != 1 )
    {
      return 0;
    }
    if( v16 == MiCombineUser && (v12 & 0x400) == 0 )
    {
      if( (v12 & 0x800) == 0
        && (((unsigned __int8)v12 >> 2) & (unsigned __int8)v23) == 0
        && (((unsigned __int8)v12 >> 1) & (unsigned __int8)v23) == 0 )
      {
        v20 = v12;
        if( *(&stru_140C4DB30 + 42) && (v12 & 0x10) == 0 )
          v20 = v12 & ~*(&stru_140C4DB30 + 42);
        if( HIDWORD(v20) == 1 )
          return 0;
      }
      if( (v12 & 0x400) == 0 && ((v12 >> 26) & 1) != 0 )
        return 0;
    }
  }
  else if( v16 == MiCombineUser )
  {
    MI_IS_RESET_PTE();
    if( v18 || (unsigned int)MI_IS_SOFTWARE_PTE_SHADOW_STACK(&v24) )
      return 0;
  }
  return v16;
}

Referenced by: