MiWriteSharedDemandZeroPte
CHAR __fastcall MiWriteSharedDemandZeroPte(INT64 a1, INT64 a2, UINT64 a3, INT64 *a4, _QWORD *a5){
__int64 v5;
unsigned __int64 v9;
__int64 v10;
INT64 v11;
int v12;
_ETHREAD *CurrentThread;
v5 = *(_QWORD *)(a3 + 24);
if( v5 )
{
++*(_QWORD *)(a3 + 16);
*(_QWORD *)(a3 + 24) = v5 + 1;
++*a5;
}
else
{
*(_QWORD *)a3 = MiSwizzleInvalidPte((*(_QWORD *)(a3 + 16) >> 54) & 0x3E0i64);
v9 = *(_QWORD *)(a3 + 16) & 0xF800000000000001ui64;
*(_QWORD *)(a3 + 24) = 1i64;
*(_QWORD *)(a3 + 16) = v9 | 1;
v10 = *(unsigned __int16 *)(a1 + 1838);
++a5[1];
_InterlockedExchangeAdd64((volatile signed __int64 *)(*(_QWORD *)(qword_140C4E388 + 8 * v10) + 7624i64), 1ui64);
}
v11 = MiSwizzleInvalidPte((a3 << 16) | 0x400) | 8;
v12 = 0;
LODWORD(CurrentThread) = MiPteInShadowRange((UINT64)a4);
if( (_DWORD)CurrentThread )
{
LODWORD(CurrentThread) = MiPteHasShadow();
if( (_DWORD)CurrentThread )
{
v12 = 1;
if( HIBYTE(word_140C4DD48) )
goto LABEL_11;
}
else
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (*(_DWORD *)(*((_QWORD *)CurrentThread + 23) + 2172i64) & 0x1000) == 0 )
goto LABEL_11;
}
if( (v11 & 1) != 0 )
v11 |= 0x8000000000000000ui64;
}
LABEL_11:
*a4 = v11;
if( v12 )
LOBYTE(CurrentThread) = MiWritePteShadow();
return(char)CurrentThread;
}Referenced by:
MiBuildForkPte