MiMarkFileOnlyPfnBad

INT64 __fastcall MiMarkFileOnlyPfnBad(UINT64 a1, UINT64 a2){
  unsigned int v2; 
  unsigned __int8 v4; 
  UNICODE_STRING *v5; 
  UINT8 v6; 
  WCHAR *v7; 
  int v8; 
  _MMPFN *v9; 
  char v10; 
  char v12; 
  v2 = a2;
  v4 = MiLockPageInline(a1);
  if( (*(_QWORD *)(a1 + 40) & 0x2000000000000i64) != 0
    && MiIsPfnFileOnly(a1)
    && (LOBYTE(v8) = MI_PFN_IS_PROTO((UNICODE_STRING *)a1, v5, v6, v7), v8)
    && (*(_DWORD *)(a1 + 16) & 0x400i64) != 0 )
  {
    if( (v2 & 0x10000000) != 0 )
    {
      v10 = *(_BYTE *)(a1 + 35);
      if( v10 >= 0 )
        *(_BYTE *)(a1 + 35) = v10 | 0x80;
    }
    if( (*(_BYTE *)(a1 + 35) & 0x40) == 0 )
    {
      if( *(_WORD *)(a1 + 32) || (*(_BYTE *)(a1 + 34) & 7u) - 2 > 1 )
      {
        MiSetPfnRemovalRequested((INT64)v9, 1i64);
        if( (*(_BYTE *)(a1 + 34) & 7) == 6 )
          MiTrimSharedPage(a1, v4, v2);
      }
      else
      {
        MiUnlinkPageFromList(v9, 0i64);
        v12 = *(_BYTE *)(a1 + 34);
        if( (v12 & 0x10) != 0 )
        {
          if( *(char *)(a1 + 35) >= 0 )
          {
            MiPersistPage((__int64)(a1 - (_QWORD)MmGetPfnDb()) / 48);
            v12 = *(_BYTE *)(a1 + 34);
          }
          *(_BYTE *)(a1 + 34) = v12 & 0xEF;
        }
        MiSetPfnRemovalRequested(a1, 1i64);
        MiInsertPageInList((_MMPFN *)a1, 4ui64);
      }
      v9 = (_MMPFN *)a1;
    }
    MiUnlockPage(v9, v4);
    return 259i64;
  }
  else
  {
    MiUnlockPage((_MMPFN *)a1, v4);
    return 3221226548i64;
  }
}

Referenced by: