MiClearDriverHotPatchPtes

CHAR __fastcall MiClearDriverHotPatchPtes(INT64 a1){
  UINT64 v2; 
  int SystemRegionType; 
  _MMPTE *PteBase; 
  __int64 v5; 
  _QWORD *v6; 
  unsigned int v7; 
  INT64 CurrentThread; 
  unsigned int v9; 
  __int64 v10; 
  _MMPFN *PfnDb; 
  unsigned __int64 v12; 
  UINT64 v13; 
  UINT64 v14; 
  INT64 TransitionPte; 
  unsigned __int64 v16; 
  unsigned __int64 v17; 
  __int64 v18; 
  char *v19; 
  unsigned __int64 v20; 
  __int64 v21; 
  char *v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  int v25; 
  bool v26; 
  int v28; 
  INT64 v29[2]; 
  INT64 result; 
  int v31; 
  __int64 v32; 
  memset((INT64)&result, 0i64);
  v2 = *(_QWORD *)(a1 + 48);
  SystemRegionType = MiGetSystemRegionType(v2);
  PteBase = MmGetPteBase();
  if( SystemRegionType == 1 )
  {
    v5 = *(_QWORD *)(a1 + 288);
    v28 = 1;
  }
  else
  {
    v28 = 0;
    v5 = (__int64)PteBase
       + 8 * (*(_DWORD *)(a1 + 64) >> 12)
       + 8 * (unsigned int)((*(_DWORD *)(a1 + 64) & 0xFFF) != 0)
       + ((v2 >> 9) & 0x7FFFFFFFF8i64);
  }
  v6 = (_QWORD *)v5;
  v7 = ((unsigned int)dword_140C4C9F0 >> 12) + ((dword_140C4C9F0 & 0xFFF) != 0);
  LOBYTE(CurrentThread) = 0;
  v9 = 0;
  v31 = 20;
  v10 = ((v5 << 25) - ((_QWORD)PteBase << 25)) >> 16;
  v32 = 0i64;
  if( v7 )
  {
    PfnDb = MmGetPfnDb();
    do
    {
      CurrentThread = MI_READ_PTE_LOCK_FREE((INT64)v6);
      v29[0] = CurrentThread;
      if( !CurrentThread )
        break;
      if( (CurrentThread & 1) != 0 )
      {
        MiInsertTbFlushEntry((INT64)&result, v10, 1i64, 0i64);
        v12 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)v29) >> 12) & 0xFFFFFFFFFi64;
        v13 = (UINT64)PfnDb + 48 * v12;
        TransitionPte = MiMakeTransitionPte(v12, 1ui64, v14);
        v16 = (unsigned __int8)MiLockPageInline(v13);
        *v6 = TransitionPte;
        MiDecrementShareCount(v13);
        _InterlockedAnd64((volatile signed __int64 *)(v13 + 24), 0x7FFFFFFFFFFFFFFFui64);
        LOBYTE(CurrentThread) = KiIrqlFlags;
        __writecr8(v16);
        PfnDb = MmGetPfnDb();
      }
      ++v6;
      v10 += 4096i64;
      ++v9;
    }
    while( v9 < v7 );
    if( v9 )
    {
      MiFlushTbList((__int64)&result);
      do
      {
        v17 = MI_READ_PTE_LOCK_FREE(v5);
        v29[0] = v17;
        if( qword_140C4DC80 )
        {
          if( (v17 & 0x10) != 0 )
            v17 &= ~0x10ui64;
          else
            v17 &= ~qword_140C4DC80;
        }
        v18 = (v17 >> 12) & 0xFFFFFFFFFi64;
        v19 = (char *)MmGetPfnDb() + 48 * v18;
        v20 = (unsigned __int8)MiLockPageInline((INT64)v19);
        v21 = *((_QWORD *)v19 + 3);
        if( (v21 & 0x3FFFFFFFFFFFFFFFi64) != 0 )
          KeBugCheckEx(0x1Au, 0x18951ui64, v5, v18, *((_QWORD *)v19 + 3) & 0x3FFFFFFFFFFFFFFFi64);
        v19[34] = v19[34] & 0xF8 | 6;
        *((_QWORD *)v19 + 3) = v21 & 0x8000000000000000ui64 | 0x4000000000000001i64;
        v22 = (char *)MmGetPfnDb() + 48 * (*((_QWORD *)v19 + 5) & 0xFFFFFFFFFi64);
        MiLockNestedPageAtDpcInline((INT64)v22);
        *((_QWORD *)v22 + 3) ^= ((*((_QWORD *)v22 + 3) - 1i64) ^ *((_QWORD *)v22 + 3)) & 0x3FFFFFFFFFFFFFFFi64;
        _InterlockedAnd64((volatile signed __int64 *)v22 + 3, 0x7FFFFFFFFFFFFFFFui64);
        v23 = *((_QWORD *)v19 + 5) & 0xFFFFFFF000000000ui64 | 0xFFFFFFFFDi64;
        *((_QWORD *)v19 + 5) = v23;
        if( v28 )
          *((_QWORD *)v19 + 5) = v23 & 0x7FFFFFFFFFFFFFFFi64;
        *((_QWORD *)v19 + 1) = 0i64;
        *((_QWORD *)v19 + 2) = 0i64;
        _InterlockedAnd64((volatile signed __int64 *)v19 + 3, 0x7FFFFFFFFFFFFFFFui64);
        __writecr8(v20);
        v24 = ZeroPte;
        v25 = 0;
        LODWORD(CurrentThread) = MiPteInShadowRange(v5);
        if( !(_DWORD)CurrentThread )
          goto LABEL_27;
        LODWORD(CurrentThread) = MiPteHasShadow();
        if( (_DWORD)CurrentThread )
        {
          v25 = 1;
          if( !HIBYTE(word_140C4DD48) )
          {
            v26 = (ZeroPte & 1) == 0;
            goto LABEL_25;
          }
        }
        else
        {
          CurrentThread = (INT64)KeGetCurrentThread();
          if( (*(_DWORD *)(*(_QWORD *)(CurrentThread + 184) + 2172i64) & 0x1000) != 0 )
          {
            v26 = (ZeroPte & 1) == 0;
LABEL_25:
            if( !v26 )
              v24 = ZeroPte | 0x8000000000000000ui64;
          }
        }
LABEL_27:
        *(_QWORD *)v5 = v24;
        if( v25 )
          LOBYTE(CurrentThread) = MiWritePteShadow();
        v5 += 8i64;
        --v9;
      }
      while( v9 );
    }
  }
  return CurrentThread;
}

Referenced by: