MiQueryLeafPte

__int64 __fastcall MiQueryLeafPte(__int64 a1, __int64 a2, int a3){
  __int64 v3; 
  int v4; 
  __int64 v5; 
  unsigned __int64 v6; 
  unsigned __int64 v7; 
  UNICODE_STRING *v8; 
  UINT8 v9; 
  WCHAR *v10; 
  UNICODE_STRING *v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  __int64 v14; 
  UNICODE_STRING *v15; 
  UINT8 v16; 
  PWCHAR v17; 
  __int16 v18; 
  UNICODE_STRING *v19; 
  UNICODE_STRING *v20; 
  PWCHAR v21; 
  int v22; 
  __int64 v23; 
  __int64 v24; 
  unsigned __int64 v25; 
  __int64 v26; 
  unsigned __int64 v27; 
  unsigned __int64 v28; 
  int v29; 
  unsigned __int64 v30; 
  __int64 v32; 
  INT64 v33; 
  v3 = *(_QWORD *)(a1 + 168);
  v4 = a3;
  v5 = a2;
  v6 = ((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  if( (v6 < qword_140C4E0A0 || v6 >= qword_140C4E0A0 + MiHyperSpaceSize()) && v4 < 1 )
  {
    v33 = MI_READ_PTE_LOCK_FREE(v5);
    if( (v33 & 1) != 0 )
    {
      v7 = MI_READ_PTE_LOCK_FREE((INT64)&v33);
      v11 = (UNICODE_STRING *)((char *)MmGetPfnDb() + 48 * ((v7 >> 12) & 0xFFFFFFFFFi64));
      if( (*(_DWORD *)v3 & 1) != 0 )
      {
        v12 = *(_QWORD *)(v3 + 16) + 1i64;
        *(_QWORD *)(v3 + 16) = v12;
        if( v12 < *(_QWORD *)(v3 + 24) )
        {
          v13 = *(_QWORD *)(v3 + 8);
          *(_QWORD *)(v13 + 8 * v12 - 8) = v6 ^ ((unsigned __int16)v6 ^ (unsigned __int16)*(_QWORD *)(v13 + 8 * v12 - 8)) & 0xFFF;
          LODWORD(v14) = MiSearchNumaNodeTable((PVOID)((__int64)(48 * ((v7 >> 12) & 0xFFFFFFFFFi64)) / 48));
          v15 = (UNICODE_STRING *)(*(_QWORD *)(v13 + 8 * v12 - 8) ^ (*(_DWORD *)(v13 + 8 * v12 - 8) ^ (*(_DWORD *)(v14 + 8) << 9)) & 0xE00);
          *(_QWORD *)(v13 + 8 * v12 - 8) = v15;
          LOBYTE(v18) = MI_PFN_IS_PROTO(v11, v15, v16, v17);
          *(_QWORD *)(v13 + 8 * v12 - 8) = (unsigned __int64)v19 ^ ((unsigned __int16)v19 ^ (unsigned __int16)(v18 << 8)) & 0x100;
          LOBYTE(v22) = MI_PFN_IS_PROTO(v20, v19, (UINT8)v19, v21);
          if( v22 )
          {
            if( (*(_DWORD *)v3 & 2) != 0 )
            {
              v25 = v24 & 0xFFFFFFFFFFFFF11Fui64 | 0xE0;
            }
            else
            {
              LOBYTE(v26) = 7;
              if( ((unsigned __int64)v11[1].Buffer & 0x3FFFFFFFFFFFFFFFi64) < 7 )
                v26 = (__int64)v11[1].Buffer & 0x3FFFFFFFFFFFFFFFi64;
              v23 = (unsigned __int8)(v24 ^ (32 * v26)) & 0xE0;
              v25 = v23 ^ v24;
            }
            *(_QWORD *)(v13 + 8 * v12 - 8) = v25;
            v27 = *(_QWORD *)(v13 + 8 * v12 - 8) ^ (*(_DWORD *)(v13 + 8 * v12 - 8) ^ (unsigned int)MiGetPfnProtection(
                                                                                                     v23,
                                                                                                     v6,
                                                                                                     (__int64)v11)) & 0x1F;
          }
          else
          {
            v28 = v24 & 0xFFFFFFFFFFFFFF1Fui64;
            *(_QWORD *)(v13 + 8 * v12 - 8) = v28;
            v27 = v28 ^ ((unsigned __int8)v28 ^ (unsigned __int8)((unsigned __int64)*(unsigned int *)&v11[1].Length >> 5)) & 0x1F;
          }
          *(_QWORD *)(v13 + 8 * v12 - 8) = v27;
          return 0i64;
        }
        return 4i64;
      }
      LOBYTE(v29) = MI_PFN_IS_PROTO(v11, v8, v9, v10);
      if( v29 )
      {
        v30 = *(_QWORD *)(v3 + 16) + 1i64;
        *(_QWORD *)(v3 + 16) = v30;
        if( v30 >= *(_QWORD *)(v3 + 24) )
          return 4i64;
        v32 = 32 * v30 + *(_QWORD *)(v3 + 8);
        MiIdentifyPfnWrapper((_MMPFN *)v11, (_MMPFN_IDENTITY *)(v32 - 32));
        *(_QWORD *)(v32 - 8) = v6;
      }
    }
  }
  return 0i64;
}

Referenced by: