MiResetAccessBitPte

NTSTATUS __fastcall MiResetAccessBitPte(INT64 a1, UNICODE_STRING *a2, ULONG *a3, PVOID *a4, _BYTE *a5){
  __int64 v5; 
  int v6; 
  _MMSUPPORT_INSTANCE *v7; 
  UINT64 v9; 
  _QWORD *v11; 
  __int64 v12; 
  UINT64 *v13; 
  unsigned __int64 v14; 
  int VaAge; 
  int v17; 
  INT64 v18; 
  unsigned __int64 v19; 
  INT64 v20; 
  INT64 v21; 
  UINT64 v22; 
  v5 = *(_QWORD *)(a1 + 168);
  v6 = (int)a3;
  v7 = *(_MMSUPPORT_INSTANCE **)(a1 + 24);
  v9 = *(_QWORD *)&a2->Length;
  v22 = v9;
  if( (v9 & 0x20) == 0 )
    return 0;
  MiPteInShadowRange((UINT64)&v22);
  v11 = (_QWORD *)((char *)MmGetPfnDb() + 48 * ((v9 >> 12) & 0xFFFFFFFFFi64));
  if( v6 )
  {
    if( (v11[3] & 0x3FFFFFFFFFFFFFFFi64) != 1 || (unsigned int)MiIsPageTableLocked((INT64)v7, (UINT64)a2) )
      return 0;
  }
  if( (v11[5] & 0x1000000000i64) == 0 )
  {
    v12 = v11[1];
    if( v12 > 0 )
      MiDemoteCombinedPte(v7, (_MMPTE *)a2, (_MMPTE *)(v12 | 0x8000000000000000ui64));
  }
  v13 = *(UINT64 **)(v5 + 16);
  v14 = (__int64)(((_QWORD)a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( !v13 || v14 > 0x7FFFFFFEFFFFi64 )
  {
    VaAge = (unsigned __int8)MiGetVaAge((INT64)v13, v14);
    if( VaAge == 7 && (unsigned int)MiGetPfnPriority((INT64)v11) < dword_140C4E56C )
    {
      v17 = 0;
    }
    else
    {
      v17 = 1;
      if( (unsigned int)(VaAge - 1) <= 5 )
        MiSetVaAgeList((INT64)v7, v14, (UINT8 *)1, 0);
    }
    v18 = *(_QWORD *)(v5 + 8);
    LODWORD(v21) = 0;
    LODWORD(v20) = *(_DWORD *)v5;
    if( !(unsigned int)MiClearPteAccessed((INT64)v7, (INT64)v11, (UINT64)a2, v18, v20, v21) )
      return 0;
    if( v17 == 1 && *(_DWORD *)v5 )
    {
      if( !v18 )
      {
        MiLogPageAccess((INT64)v7, (UINT64)a2);
        return 0;
      }
    }
    else if( !v18 )
    {
      return 0;
    }
    v19 = qword_140C4DCD0;
    if( (*(_BYTE *)(v18 + 4) & 2) == 0
      && *(_DWORD *)v18 == 1
      && *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2288i64) )
    {
      v19 = -1i64;
    }
    if( (*(_DWORD *)(v18 + 12) >= *(_DWORD *)(v18 + 8) || *(_BYTE *)(v18 + 5) || *(_QWORD *)(v18 + 16) > v19)
      && v19 >= 0x400
      && !*(_BYTE *)(v18 + 5) )
    {
      MiFlushTbList(v18);
    }
    return 0;
  }
  if( (unsigned int)MiInsertVmAccessedEntry(v13, v14) )
    return MiResetAccessBitsTail(a1);
  return 0;
}

Referenced by: