MiDemoteCombinedPte

INT64 __fastcall MiDemoteCombinedPte(_MMSUPPORT_INSTANCE *Vm, _MMPTE *PoINTerPte, _MMPTE *ProtoPte){
  INT64 v3; 
  bool v6; 
  INT64 v7; 
  char *v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  char WsleContents; 
  __int64 v13; 
  unsigned __int8 v14; 
  UINT64 v15; 
  __int16 v16; 
  unsigned __int64 v17; 
  __int64 v19; 
  unsigned __int64 v20; 
  _MMPFN *PfnDb; 
  UINT64 v22; 
  UINT64 Flag; 
  int v24; 
  __int64 v25; 
  __int64 v26; 
  INT64 v27; 
  __int64 v28; 
  unsigned __int64 v29; 
  UINT64 v30; 
  INT64 v31; 
  MMPTE *ProtoPtea; 
  UINT64 a2[2]; 
  __int64 v34; 
  EVENT_DATA_DESCRIPTOR EventData; 
  v3 = *(_QWORD *)PoINTerPte;
  ProtoPtea = ProtoPte;
  *(_OWORD *)a2 = 0i64;
  v34 = 0i64;
  v31 = (INT64)Vm;
  v6 = *((_QWORD *)ProtoPte - 2) <= 1ui64;
  v7 = (INT64)ProtoPte - 48;
  v27 = v3;
  if( !v6 )
    return 0i64;
  v25 = *(_QWORD *)((v7 & 0xFFFFFFFFFFFFF000ui64) + 0x10);
  v8 = (char *)MmGetPfnDb() + 48 * (((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v27) >> 12) & 0xFFFFFFFFFi64);
  v9 = (*((_QWORD *)v8 + 5) >> 39) & 0x3FFi64;
  v10 = (__int64)(((_QWORD)PoINTerPte << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  v30 = v10;
  v28 = *(_QWORD *)(qword_140C4E388 + 8 * v9);
  v11 = 0i64;
  if( (*(_BYTE *)&Vm->Flags.0 & 7) == 0 )
  {
    v11 = *((_QWORD *)KeGetCurrentThread() + 23);
    if( *(_QWORD *)(v11 + 1248) )
      return 0i64;
  }
  WsleContents = MiGetWsleContents(v9, v10);
  v29 = (unsigned __int64)MI_READ_PTE_LOCK_FREE(v13 + (((unsigned __int64)PoINTerPte >> 9) & 0x7FFFFFFFF8i64)) >> 12;
  v24 = HIDWORD(PerfGlobalGroupMask) & 0x8000001;
  v14 = MiLockPageInline((INT64)v8);
  v16 = *((_WORD *)v8 + 16);
  v17 = v14;
  if( (v16 == 1 || v16 == 2 && (v8[34] & 8) != 0)
    && *(_QWORD *)(qword_140C4E388 + 8i64 * Vm->PartitionId) == v28
    && _InterlockedCompareExchange64((volatile signed __int64 *)(v7 + 32), 0i64, 1i64) == 1 )
  {
    _InterlockedExchangeAdd((volatile signed __int32 *)(v25 + 392), 0xFFFFFFFF);
    v19 = *((_QWORD *)v8 + 5);
    *((_QWORD *)v8 + 1) = PoINTerPte;
    v26 = v19 & 0xFFFFFFFFFi64;
    v20 = *((_QWORD *)v8 + 2);
    *((_QWORD *)v8 + 5) = v29 & 0xFFFFFFFFFi64 | v19 & 0x7FFFFFF000000000i64;
    if( ((v20 >> 5) & 5) == 5 )
      *((_QWORD *)v8 + 2) = v20 ^ ((unsigned __int16)v20 ^ (unsigned __int16)(32 * ((v20 >> 5) & 0xFFFE))) & 0x3E0;
    if( v24 )
      MiIdentifyPfn((_MMPFN *)v8, a2);
    _InterlockedAnd64((volatile signed __int64 *)v8 + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(v17);
    if( (v3 & 0x200) != 0 )
    {
      v27 = v3 & 0xFFFFFFFFFFFFF5DFui64 | 0x820;
      MiWriteValidPteNewProtection((INT64 *)PoINTerPte, v27);
    }
    PfnDb = MmGetPfnDb();
    v22 = (UINT64)PfnDb + 48 * v26;
    if( (WsleContents & 0xF) == 8 )
      MiUnlockPageTableCharges((_MMPFN *)((char *)PfnDb + 48 * v26), 1u, v15);
    MiLockAndDecrementShareCount(v22, 0);
    MiUpdateWorkingSetPrivateSize(v31, v30, 1i64, 0i64);
    if( v11 )
      _InterlockedExchangeAdd64((volatile signed __int64 *)(v11 + 1272), 1ui64);
    if( v24 )
    {
      MiLogCombinedPteDelete(ProtoPtea);
      *(_QWORD *)&EventData.Size = 24i64;
      EventData.Ptr = (unsigned __int64)a2;
      LODWORD(Flag) = 289413890;
      EtwTraceKernelEvent(&EventData, 1ui64, 0x28000001ui64, 0x276u, Flag);
    }
    MiFreeCombineBlock(v7);
    return 1i64;
  }
  else
  {
    _InterlockedAnd64((volatile signed __int64 *)v8 + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(v14);
    return 0i64;
  }
}

Referenced by: