MiRemoveWsleList
char *MiRemoveWsleList(__int64 a1, __int64 a2, char *a3, ...){
__int64 v3;
char v5;
int *v6;
char *result;
__int64 v8;
__int64 v10;
__int64 v11;
unsigned __int64 v12;
_MMPTE *PdeBase;
UINT64 *v14;
UINT64 v15;
_MMPTE *PteBase;
char *v17;
int v18;
char v19;
UINT64 v20;
int v21;
UINT64 *v22;
char *v23;
UINT64 v24;
void(__fastcall *v25)(void *, void *, _IO_WORKITEM *);
UINT64 v26;
__int64 v27;
_MMPTE *Pml4eBase;
unsigned __int64 v29;
char v30;
__int64 v31;
unsigned __int8 v32;
UINT64 v33;
__int64 *v34;
__int64 v35;
unsigned __int8 v36;
__int64 v37;
__int64 v38;
__int64 v39;
__int64 *v40;
INT64 v41;
_QWORD *v42;
__int64 v43;
__int64 **v44;
__int64 v45;
__int64 **v46;
unsigned int v47;
int v48;
int v49;
__int64 v50;
__int64 v51;
__int64 v52;
__int64 v53;
char *v54;
int *v55;
__int64 v56;
struct _IO_WORKITEM v57;
__int64 v60;
UINT64 v62;
va_list va;
va_list va1;
va_start(va1, a3);
va_start(va, a3);
v62 = va_arg(va1, _QWORD);
v3 = a1;
v57.IoObject = 0i64;
v5 = *(_BYTE *)(a1 + 184) & 7;
v50 = 0i64;
v52 = 0i64;
v6 = &dword_140C4F540;
v53 = 0i64;
if( v5 != 2 )
v6 = 0i64;
v47 = 0;
v55 = v6;
result = 0i64;
v54 = 0i64;
v8 = 0i64;
v51 = 0i64;
v48 = 0;
v10 = 0i64;
v11 = 0i64;
v12 = 0i64;
if( v62 )
{
PdeBase = MmGetPdeBase();
v56 = a2 + 24;
v14 = (UINT64 *)(a2 + 24);
v15 = v62;
PteBase = MmGetPteBase();
v17 = &a3[-a2];
v18 = 0;
do
{
v19 = *((_BYTE *)v14 + (_QWORD)v17 - 23);
if( (v19 & 1) != 0 )
{
v20 = *v14;
v50 = ++v10;
if( *v14 < (unsigned __int64)PteBase || v20 > (unsigned __int64)MmGetPteLimit() )
{
v48 = 2;
v54 = (char *)PdeBase + ((v20 >> 18) & 0x3FFFFFF8);
PteBase = MmGetPteBase();
}
else
{
v48 = 1;
}
if( (v19 & 2) != 0 )
{
v51 = ++v8;
if( v20 < (unsigned __int64)PteBase || v20 > (unsigned __int64)MmGetPteLimit() )
v52 = ++v11;
}
if( (*(_BYTE *)(v3 + 184) & 7) == 4 )
{
if( PsNtosImageBase
&& (v20 >= PsNtosImageBase && v20 < PsNtosImageEnd
|| v20 < PsHalImageEnd && v20 >= (unsigned __int64)PsHalImageBase) )
{
v12 = (unsigned int)(v12 + 1);
v47 = v12;
}
else if( (unsigned int)MiGetSystemRegionType(v20) == 12 )
{
v42 = MiIsDriverPage((INT64)PteBase + ((v20 >> 9) & 0x7FFFFFFFF8i64));
v8 = v51;
v11 = v52;
v12 = v47;
v10 = v50;
PdeBase = MmGetPdeBase();
if( v42 )
++v18;
}
else
{
v8 = v51;
v11 = v52;
v12 = v47;
v10 = v50;
PdeBase = MmGetPdeBase();
}
}
}
++v14;
--v15;
}
while( v15 );
v21 = v48;
v22 = (UINT64 *)v56;
v23 = a3;
v49 = v18;
v24 = v62;
if( v48 )
{
if( (*(_BYTE *)(v3 + 184) & 7) == 2 )
v25 = (void(__fastcall *)(void *, void *, _IO_WORKITEM *))&qword_140C4F500;
else
v25 = (void(__fastcall *)(void *, void *, _IO_WORKITEM *))(v3 + 256);
v57.Routine = v25;
v57.WorkItem.Parameter = 0i64;
KxAcquireQueuedSpinLock(
(PIO_WORKITEM)&v57.WorkItem.Parameter,
(PIO_WORKITEM_ROUTINE)v25,
(WORK_QUEUE_TYPE)v11,
(PVOID)v12);
if( v51 )
{
*(_QWORD *)(v3 + 144) -= v51;
if( v52 )
*(_QWORD *)(v3 + 128) -= v52;
}
if( v47 )
LODWORD(xmmword_140C4CA88) = xmmword_140C4CA88 - v47;
if( v49 )
DWORD1(xmmword_140C4CA88) -= v49;
v26 = 0i64;
*(_QWORD *)(v3 + 136) -= v50;
v27 = a2 - (_QWORD)a3;
v60 = a2 - (_QWORD)a3;
while( 1 )
{
Pml4eBase = MmGetPml4eBase();
if( (v23[v27 + 1 + (_QWORD)v17] & 1) == 0 )
goto LABEL_38;
v29 = *(_QWORD *)&v23[v27 + 24];
if( v21 != 1 )
break;
if( (*(_BYTE *)(v3 + 184) & 7) == 0 )
{
v30 = *v23;
LABEL_28:
v32 = v30 & 0xF;
if( v29 < (unsigned __int64)MmGetPteBase() || v29 > (unsigned __int64)MmGetPteLimit() )
{
v33 = *(_QWORD *)((char *)MmGetPdeBase() + ((v29 >> 18) & 0x3FFFFFF8));
v62 = v33;
MiPteInShadowRange((UINT64)va);
v34 = (__int64 *)((char *)MmGetPfnDb() + 48 * ((v33 >> 12) & 0xFFFFFFFFFi64));
v35 = *v34;
v36 = ((unsigned __int64)*v34 >> 14) & 7;
if( (((unsigned __int64)*v34 >> 4) & 0x3FF) != 0 )
{
if( v32 == v36 )
{
*v34 = v35 ^ ((unsigned __int16)v35 ^ (unsigned __int16)(16
* ((((unsigned __int64)*v34 >> 4) & 0x3FF) - 1))) & 0x3FF0;
}
else if( v32 > v36 )
{
*v34 = v35 ^ ((unsigned int)v35 ^ (v32 << 14)) & 0x1C000 | 0x3FF0;
}
}
}
--*(_QWORD *)(v3 + 8i64 * v32 + 40);
if( v32 == 7 )
{
v37 = *(unsigned __int16 *)(v3 + 174);
memset(&v57, 0, 24);
v38 = *(_QWORD *)(qword_140C4E388 + 8 * v37);
v39 = *(_QWORD *)(v38 + 6848);
if( *(_QWORD *)(a1 + 96) < *(_QWORD *)(v39 + 56) )
{
v40 = (__int64 *)(a1 + 24);
if( *(_QWORD *)(a1 + 24) )
{
if( *(__int64 **)(v38 + 6864) != v40 )
{
v57.WorkItem.List.Blink = (_LIST_ENTRY *)&WorkerRoutine;
v57.WorkItem.List.Flink = 0i64;
KxAcquireQueuedSpinLock(
&v57,
(PIO_WORKITEM_ROUTINE)&WorkerRoutine,
(WORK_QUEUE_TYPE)&WorkerRoutine,
Pml4eBase);
if( *(_BYTE *)(v39 + 53) || (v43 = *v40) == 0 )
{
*(_BYTE *)(v39 + 54) = 1;
KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&v57);
}
else
{
if( *(__int64 **)(v43 + 8) != v40
|| (v44 = *(__int64 ***)(a1 + 32), *v44 != v40)
|| (*v44 = (__int64 *)v43,
v45 = v38 + 6856,
*(_QWORD *)(v43 + 8) = v44,
v46 = *(__int64 ***)(v45 + 8),
*v46 != (__int64 *)v45) )
{
__fastfail(3u);
}
*v40 = v45;
*(_QWORD *)(a1 + 32) = v46;
*v46 = v40;
*(_QWORD *)(v45 + 8) = v40;
KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&v57);
}
}
}
}
v3 = a1;
}
LABEL_37:
v27 = v60;
}
LABEL_38:
++v26;
v23 += 8;
if( v26 >= v24 )
{
if( v55 )
{
*((_QWORD *)v55 + 1) -= v50;
if( v53 )
*((_QWORD *)v55 + 2) -= v53;
}
KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&v57.WorkItem.Parameter);
do
{
if( (v17[(_QWORD)v22 - 23] & 1) != 0 && v48 == 2 )
{
v41 = *((unsigned __int8 *)MmGetPteBase() + ((*v22 >> 9) & 0x7FFFFFFFF8i64));
if( (v41 & 1) != 0 )
MiWriteWsle(v41, *v22, 0xAu);
}
++v22;
--v24;
}
while( v24 );
return v54;
}
v21 = v48;
}
--*(_QWORD *)(v3 + 120);
v30 = *v23;
v31 = v53 + 1;
if( !v55 )
v31 = v53;
v53 = v31;
if( (v30 & 0xF) != 8 )
{
v53 = v31;
goto LABEL_28;
}
goto LABEL_37;
}
return v54;
}
return result;
}Referenced by:
MiFreeWsleList
MmUnmapViewInSystemCache