MiDeleteEmptyPageTable

NTSTATUS __fastcall MiDeleteEmptyPageTable(_TOKEN *SourceLowboxToken, UINT64 a2){
  _QWORD *PrimaryGroup; 
  __int64 v5; 
  __int64 v6; 
  _MI_TB_FLUSH_LIST *TokenId; 
  __int64 v8; 
  int v9; 
  unsigned __int64 v10; 
  UINT64 LogAccess; 
  unsigned __int64 v13; 

  PrimaryGroup = SourceLowboxToken->PrimaryGroup;
  LODWORD(LogAccess) = 0;
  LODWORD(v5) = MI_READ_PTE_LOCK_FREE(a2);
  v6 = v5;
  if( (v5 & 1) != 0 && (v5 & 0x80u) == 0i64 )
  {
    if( MiIsPageTableDeletable(SourceLowboxToken, (_TOKEN **)a2) )
    {
      TokenId = (_MI_TB_FLUSH_LIST *)SourceLowboxToken->TokenId;
      v8 = (__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
      MiTerminateWsle(
        *(VOID **)&SourceLowboxToken->AuthenticationId,
        (_MMSUPPORT_INSTANCE *)v8,
        0i64,
        (UINT64)&LogAccess);
      if( v9 )
      {
        if( (_DWORD)LogAccess == 1 )
          MiInsertTbFlushEntry(TokenId, (VOID *)v8, 1ui64, 0i64);
        v10 = v6 & 0xFFFFFFFFFFFFFBFEui64 | 0x400;
        v13 = v10;
        MiPteInShadowRange(a2);
        *(_QWORD *)a2 = v10;
        MiFlushTbListEarly(TokenId, 0i64);
        _bittestandset64(PrimaryGroup + 3, (a2 >> 3) & 0x1FF);
        if( !*PrimaryGroup )
          *PrimaryGroup = a2;
      }
    }
  }
  return 0;
}

Referenced by:

No references.