MiDeleteEmptyPageTable
NTSTATUS __fastcall MiDeleteEmptyPageTable(_TOKEN *SourceLowboxToken, UINT64 a2){
_QWORD *PrimaryGroup;
__int64 v5;
__int64 v6;
_MI_TB_FLUSH_LIST *TokenId;
__int64 v8;
int v9;
unsigned __int64 v10;
UINT64 LogAccess;
unsigned __int64 v13;
PrimaryGroup = SourceLowboxToken->PrimaryGroup;
LODWORD(LogAccess) = 0;
LODWORD(v5) = MI_READ_PTE_LOCK_FREE(a2);
v6 = v5;
if( (v5 & 1) != 0 && (v5 & 0x80u) == 0i64 )
{
if( MiIsPageTableDeletable(SourceLowboxToken, (_TOKEN **)a2) )
{
TokenId = (_MI_TB_FLUSH_LIST *)SourceLowboxToken->TokenId;
v8 = (__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
MiTerminateWsle(
*(VOID **)&SourceLowboxToken->AuthenticationId,
(_MMSUPPORT_INSTANCE *)v8,
0i64,
(UINT64)&LogAccess);
if( v9 )
{
if( (_DWORD)LogAccess == 1 )
MiInsertTbFlushEntry(TokenId, (VOID *)v8, 1ui64, 0i64);
v10 = v6 & 0xFFFFFFFFFFFFFBFEui64 | 0x400;
v13 = v10;
MiPteInShadowRange(a2);
*(_QWORD *)a2 = v10;
MiFlushTbListEarly(TokenId, 0i64);
_bittestandset64(PrimaryGroup + 3, (a2 >> 3) & 0x1FF);
if( !*PrimaryGroup )
*PrimaryGroup = a2;
}
}
}
return 0;
}Referenced by:
No references.