MiPurgeFileOnlyPfn

INT64 __fastcall MiPurgeFileOnlyPfn(INT64 a1){
  __int64 v1; 
  unsigned int v2; 
  __int64 v3; 
  __int64 v4; 
  _MMPTE *v5; 
  UINT64 v6; 
  _MMPFN *v7; 
  _MMPFN *v8; 
  unsigned __int64 v9; 
  ULONG_PTR BugCheckParameter4; 
  INT64 result; 
  UINT8 *PfnDb; 
  char v13; 
  INT64 a2[2]; 
  __int128 v15; 
  __int64 v16; 
  UINT8 PageIrql; 
  v1 = *(_QWORD *)(a1 + 16);
  v2 = 0;
  *(_OWORD *)a2 = 0i64;
  v15 = 0i64;
  v16 = 0i64;
  if( qword_140C4DC80 && (v1 & 0x10) == 0 )
    v1 &= ~qword_140C4DC80;
  v3 = *(_QWORD *)(a1 + 8);
  v4 = v1 >> 16;
  PageIrql = 17;
  v5 = (_MMPTE *)(v3 | 0x8000000000000000ui64);
  MiChangingSubsectionProtos((PVOID)v4);
  v7 = MiCheckProtoPtePageState(v5, &PageIrql);
  if( v7 )
  {
    v8 = MiLockLeafPage(v5, 0i64);
    if( v8 )
    {
      v9 = MI_READ_PTE_LOCK_FREE((INT64)v5);
      BugCheckParameter4 = v9;
      if( (v9 & 1) != 0 )
        goto LABEL_7;
      if( qword_140C4DC80 )
      {
        if( (v9 & 0x10) != 0 )
          v9 &= ~0x10ui64;
        else
          v9 &= ~qword_140C4DC80;
      }
      PfnDb = (UINT8 *)MmGetPfnDb();
      v6 = (UINT64)&PfnDb[48 * ((v9 >> 12) & 0xFFFFFFFFFi64)];
      if( v8 != (_MMPFN *)v6 )
        goto LABEL_7;
      if( (*((_DWORD *)v8 + 4) & 0x401) != 1024i64 || (_MMPTE *)(*((_QWORD *)v8 + 1) | 0x8000000000000000ui64) != v5 )
        KeBugCheckEx(0xDEu, 2ui64, (ULONG_PTR)v5, *((_QWORD *)v8 + 1), BugCheckParameter4);
      v13 = *((_BYTE *)v8 + 34);
      if( (v13 & 8) != 0 )
      {
LABEL_7:
        _InterlockedAnd64((volatile signed __int64 *)v8 + 3, 0x7FFFFFFFFFFFFFFFui64);
      }
      else
      {
        if( (v13 & 0x10) != 0 )
        {
          if( *((char *)v8 + 35) >= 0 )
          {
            MiPersistPage((v8 - (_MMPFN *)PfnDb) / 48);
            v13 = *((_BYTE *)v8 + 34);
          }
          *((_BYTE *)v8 + 34) = v13 & 0xEF;
        }
        LOBYTE(PfnDb) = 2;
        MiDeleteTransitionPte(v5, v8, PfnDb, 1ui64);
        v2 = 1;
      }
    }
  }
  LOBYTE(v6) = PageIrql;
  if( PageIrql != 17 )
    MiUnlockProtoPoolPage(v7, v6);
  MiSubsectionProtosCreated((INT64 *)v4, (INT64)a2, 0i64, v2);
  return result;
}

Referenced by: