MiMarkPfnVerified

CHAR __fastcall MiMarkPfnVerified(UINT64 a1, CHAR dl0){
  WCHAR *v2; 
  unsigned int v3; 
  signed __int64 v5; 
  __int64 v6; 
  unsigned __int8 v7; 
  int v8; 
  char v9; 
  int v10; 
  __int16 v11; 
  CHAR result; 
  __int128 a2; 
  v3 = dl0;
  a2 = 0i64;
  v5 = a1 - (_QWORD)MmGetPfnDb();
  v6 = v5 / 48;
  if( (dl0 & 4) != 0 )
    v7 = 17;
  else
    v7 = MiLockPageInline(a1);
  if( (v3 & 2) != 0 && ((*(_QWORD *)(a1 + 40) >> 60) & 7) == 3 )
    v3 &= ~2u;
  if( (v3 & 2) != 0 && (MiFlags & 0x10000) != 0 )
  {
    LOBYTE(v8) = MI_PFN_IS_PROTO((UNICODE_STRING *)a1, (UNICODE_STRING *)v3, v5, v2);
    if( !v8 && (MiFlags & 0x8000) != 0 )
      *(_QWORD *)&a2 = (__int64)((*(_QWORD *)(a1 + 8) << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
    v10 = v3 & 1;
    LOBYTE(v3) = v9 & 0xFE;
    if( !v10 )
      LOBYTE(v3) = v9;
    v11 = 4 * v10 + 2;
    if( (v3 & 0x20) != 0 )
    {
      v11 |= 0x40u;
      if( (*(_BYTE *)(a1 + 34) & 0x10) == 0 && (*(_DWORD *)(a1 + 16) & 4) == 0 )
        v11 |= 0x800u;
    }
    if( KeSetPagePrivilege(v6, &a2, v11) < 0 )
      KeBugCheckEx(0x1Au, 0x5150Cui64, v6, 0i64, 0i64);
  }
  result = (*(_QWORD *)(a1 + 40) >> 60) & 7;
  if( result != 3 )
  {
    result = 0;
    *(_QWORD *)(a1 + 40) = *(_QWORD *)(a1 + 40) & 0x8FFFFFFFFFFFFFFFui64 | 0x3000000000000000i64;
  }
  if( (v3 & 1) != 0 && (MiFlags & 0x10000) != 0 )
  {
    MiGetPagePrivilege(a1, 1, (unsigned __int64 *)&a2);
    result = KeSetPagePrivilege(v6, &a2, 4);
  }
  if( v7 != 17 )
  {
    _InterlockedAnd64((volatile signed __int64 *)(a1 + 24), 0x7FFFFFFFFFFFFFFFui64);
    result = v7;
    __writecr8(v7);
  }
  return result;
}

Referenced by: