MiDeletePteList
INT64 __fastcall MiDeletePteList(INT64 a1, volatile INT64 *a2, UINT64 a3, _QWORD *a4, INT64 a5){
int v5;
char *v8;
unsigned int v9;
unsigned __int64 v10;
__int64 v11;
_MMPTE *PteBase;
__int64 v13;
__int64 v14;
unsigned __int64 v15;
__int64 v16;
__int64 v17;
_MMPFN *PfnDb;
__int64 v19;
UNICODE_STRING *v20;
UINT64 v21;
MMPTE *v22;
int v23;
__int64 v24;
UINT64 v25;
__int64 v26;
int v27;
_MMPTE *v28;
bool v29;
UINT64 ContainingPageTable;
UINT64 v31;
UINT64 v32;
signed __int8 v33;
INT64 v34;
int v35;
_QWORD *CloneAddress;
volatile INT64 *v37;
unsigned __int64 v38;
__int64 v39;
UNICODE_STRING *v40;
int v41;
unsigned __int64 v42;
INT64 v43;
INT64 v44;
__int64 v45;
char v46;
char v47;
char v48;
INT64 v49;
INT64 v50;
char v51;
UINT64 v52;
INT64 v53;
__int64 v54;
UINT64 v55;
INT64 updated;
__int16 v57;
unsigned __int64 v58;
INT64 v59;
int v60;
__int64 v61;
unsigned int v62;
bool v63;
__int64 v64;
INT64 a2a;
unsigned __int64 v67;
UINT64 v68;
INT64 v69;
INT64 v70;
UINT64 v71;
UINT64 SpinCount;
UINT64 v73;
INT64 v74;
INT64 a1a;
INT64 v76;
__int64 v77;
__int64 v78;
unsigned __int64 v79;
__int64 v80;
__int64 v81;
INT64 v82;
unsigned int a5a;
v82 = a1;
v5 = *(_DWORD *)(a1 + 12);
v8 = 0i64;
v69 = 0i64;
v9 = 0;
LODWORD(a2a) = 0;
v78 = -1i64;
LODWORD(v70) = v5;
if( (_DWORD)a5 )
{
MiFlushTbList(a1);
a1 = v82;
v5 = v70;
}
if( a4[4] || a4[5] )
return 0i64;
v10 = 0i64;
a5a = 0;
if( v5 )
{
v11 = 0i64;
PteBase = MmGetPteBase();
v81 = 0i64;
do
{
v13 = *(_QWORD *)(a1 + 8 * v11 + 24);
v14 = (v13 & 0x3FF) + 1;
v15 = v13 & 0xFFFFFFFFFFFFF000ui64;
v80 = v14;
v79 = v15;
do
{
v16 = (v15 >> 9) & 0x7FFFFFFFF8i64;
v17 = *(_QWORD *)((char *)PteBase + v16);
v76 = (INT64)PteBase + v16;
v67 = v17 & 0xFFFFFFFFFFFFFBFEui64 | 1;
PfnDb = MmGetPfnDb();
v19 = 48 * ((v67 >> 12) & 0xFFFFFFFFFi64);
v20 = *(UNICODE_STRING **)((char *)PfnDb + v19 + 40);
v21 = (UINT64)PfnDb + v19;
v22 = *(MMPTE **)(qword_140C4E388 + 8 * (((unsigned __int64)v20 >> 39) & 0x3FF));
a1a = (INT64)v22;
LOBYTE(v23) = MI_PFN_IS_PROTO(
(UNICODE_STRING *)((char *)PfnDb + v19),
v20,
v67 >> 12,
(PWCHAR)((char *)PteBase + v16));
if( v23 )
{
v28 = (_MMPTE *)(*(_QWORD *)(v21 + 8) | 0x8000000000000000ui64);
v29 = (v24 & 0x1000000000i64) == 0 && *(__int64 *)(v21 + 8) > 0;
ContainingPageTable = MiGetContainingPageTable(v25);
LODWORD(SpinCount) = v31;
v32 = v31;
v33 = _interlockedbittestandset64((volatile signed __int32 *)(v21 + 24), 0x3Fui64);
v77 = ContainingPageTable;
if( v33 )
{
do
{
do
KeYieldProcessorEx(&SpinCount);
while( *(__int64 *)(v21 + 24) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)(v21 + 24), 0x3Fui64) );
}
if( (v67 & 0x42) != 0 )
v32 = MiCaptureDirtyBitToPfn(v21);
MiDecrementShareCount(v21);
_InterlockedAnd64((volatile signed __int64 *)(v21 + 24), 0x7FFFFFFFFFFFFFFFui64);
if( v32 )
MiReleasePageFileInfo(a1a, v32, 1, v34, a2a, v67, v69, v70, v71, SpinCount, v73, v74);
if( v29 )
{
v35 = MiDecrementCombinedPte((INT64)(a2 + 208), v28);
}
else
{
CloneAddress = MiLocateCloneAddress((__int64)a2, (unsigned __int64)v28);
v35 = MiDecrementCloneBlockReference((UINT64)CloneAddress, v37, (UINT64)a2);
}
if( v35 == 3 )
{
v68 = a3;
++a4[1];
}
else
{
if( v35 == 5 )
++a4[2];
v68 = a3;
}
}
else
{
HIDWORD(SpinCount) = v27;
v33 = _interlockedbittestandset64((volatile signed __int32 *)(v21 + 24), 0x3Fui64);
v77 = v26 & v24;
if( v33 )
{
do
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *(__int64 *)(v21 + 24) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)(v21 + 24), 0x3Fui64) );
}
v38 = *(_QWORD *)(v21 + 16);
*(_QWORD *)(v21 + 24) |= 0x4000000000000000ui64;
if( (v38 & 2) != 0 && !(unsigned int)MI_IS_PTE_IN_WS_SWAP_SET(v22) && *(_WORD *)(v21 + 32) == 1 && a3 )
{
v10 = v38;
v38 &= ~2ui64;
*(_QWORD *)(v21 + 16) = v38;
}
if( (*(_BYTE *)(v21 + 34) & 7) != 6 )
MiBadShareCount((_MMPFN *)v21);
v39 = (*(_QWORD *)(v21 + 24) & 0x3FFFFFFFFFFFFFFFi64) - 1;
v40 = (UNICODE_STRING *)(*(_QWORD *)(v21 + 24) ^ (*(_QWORD *)(v21 + 24) ^ v39) & 0x3FFFFFFFFFFFFFFFi64);
*(_QWORD *)(v21 + 24) = v40;
if( !v39 )
{
LOBYTE(v41) = MI_PFN_IS_PROTO((UNICODE_STRING *)v21, v40, 0xFFu, (PWCHAR)v38);
if( v41 )
{
MiMakeProtoTransition(v43);
v42 = *(_QWORD *)(v21 + 24);
}
--*(_WORD *)(v21 + 32);
v45 = (v42 >> 62) & 1;
if( *(_WORD *)(v21 + 32) )
{
v46 = *(_BYTE *)(v21 + 34);
if( (_DWORD)v45 )
{
v47 = v46 | 7;
}
else if( (v46 & 0x10) != 0 )
{
v47 = v46 & 0xF8 | 3;
}
else
{
v47 = v46 & 0xF8 | 2;
}
*(_BYTE *)(v21 + 34) = v47;
if( (*(_DWORD *)(v21 + 16) & 0x400i64) == 0 && (unsigned int)MiGetPagingFileOffset((MMPTE *)(v21 + 16)) )
*(_BYTE *)(*(_QWORD *)(qword_140C4E388 + 8 * ((*(_QWORD *)(v21 + 40) >> 39) & 0x3FFi64)) + 675i64) = 1;
++a4[1];
}
else if( (_DWORD)v45 )
{
v48 = *(_BYTE *)(v21 + 35);
if( (v48 & 0x10) != 0 )
*(_BYTE *)(v21 + 35) = v48 & 0xEF;
v49 = *(_QWORD *)(qword_140C4E388 + 8 * ((*(_QWORD *)(v21 + 40) >> 39) & 0x3FFi64));
v74 = *(_QWORD *)(v21 + 16);
if( (v74 & 0x400) == 0 )
{
v50 = (v74 & 4) != 0 || (v74 & 2) != 0 ? MI_READ_PTE_LOCK_FREE((INT64)&v74) : 0i64;
v74 = v50;
if( v50 )
MiReleasePageFileInfo(v49, v50, 0, v44, a2a, v67, v69, v70, v71, SpinCount, v73, v74);
}
MiInsertPageInFreeOrZeroedList(v19 / 48, 2ui64);
}
else
{
MiSetNonResidentPteHeat((UINT64 *)(v21 + 16), 0i64);
v51 = *(_BYTE *)(v21 + 34);
if( (v51 & 0x10) != 0 )
{
v52 = 8i64;
}
else
{
v52 = 4i64;
*(_BYTE *)(v21 + 34) = v51 & 0xF8 | 2;
}
MiInsertPageInList((_MMPFN *)v21, v52);
}
}
_InterlockedAnd64((volatile signed __int64 *)(v21 + 24), 0x7FFFFFFFFFFFFFFFui64);
v68 = a3;
if( v10 )
{
if( qword_140C4DC80 && (v10 & 0x10) == 0 )
v10 &= ~qword_140C4DC80;
v53 = HIDWORD(v10);
v71 = a3;
MiSetNonResidentPteHeat(&v71, 0i64);
v55 = v71;
if( (a3 & 0x400) == 0 )
{
v55 = v71 & 0xFFFFFFFFFFFFFFF9ui64;
v71 &= 0xFFFFFFFFFFFFFFF9ui64;
}
if( v54 )
{
if( v55 )
updated = MiUpdatePageFileHighInPte(v55, v53);
else
updated = MiSwizzleInvalidPte(v53 << 32);
v55 = updated ^ (unsigned __int16)(updated ^ (v57 << 12)) & 0xF000 | 2;
v71 = v55;
}
v68 = v55;
v10 = 0i64;
}
_InterlockedExchangeAdd64(a2 + 159, 0xFFFFFFFFFFFFFFFFui64);
}
v58 = v68;
v59 = v76;
if( v76 >= (unsigned __int64)MmGetPml4eBase()
&& v76 <= (unsigned __int64)MmGetPxeUserLimit()
&& (*(_DWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 2172i64) & 0x1000) != 0
&& (v68 & 1) != 0 )
{
v58 = v68 | 0x8000000000000000ui64;
}
*(_QWORD *)v76 = v58;
v60 = v69;
if( !v68 )
{
v60 = v69 + 1;
LODWORD(v69) = v69 + 1;
}
v61 = v77;
if( v77 != v78 )
{
if( v8 )
{
LODWORD(v73) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)v8 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v73);
while( *((__int64 *)v8 + 3) < 0 );
}
MiReduceShareCount((UINT64)v8, (unsigned int)a2a);
_InterlockedAnd64((volatile signed __int64 *)v8 + 3, 0x7FFFFFFFFFFFFFFFui64);
LODWORD(a2a) = 0;
if( v60 )
{
HIDWORD(v69) = MiReducePteUseCount(v59, v60);
v60 = 0;
LODWORD(v69) = 0;
}
}
v8 = (char *)MmGetPfnDb() + 48 * v61;
v78 = v61;
}
v62 = a2a + 1;
v15 = v79 + 4096;
LODWORD(a2a) = a2a + 1;
v63 = v80-- == 1;
v79 += 4096i64;
PteBase = MmGetPteBase();
}
while( !v63 );
v11 = v81 + 1;
++a5a;
a1 = v82;
++v81;
}
while( a5a < (unsigned int)v70 );
if( !v62 )
return HIDWORD(v69);
HIDWORD(v73) = 0;
if( _interlockedbittestandset64((volatile signed __int32 *)v8 + 6, 0x3Fui64) )
{
do
{
do
KeYieldProcessorEx((UINT64 *)((char *)&v73 + 4));
while( *((__int64 *)v8 + 3) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)v8 + 6, 0x3Fui64) );
v62 = a2a;
}
if( (v8[34] & 7) != 6 )
MiBadShareCount((_MMPFN *)v8);
v64 = (*((_QWORD *)v8 + 3) & 0x3FFFFFFFFFFFFFFFi64) - v62;
*((_QWORD *)v8 + 3) ^= (*((_QWORD *)v8 + 3) ^ v64) & 0x3FFFFFFFFFFFFFFFi64;
if( !v64 )
MiPfnShareCountIsZero((UINT64)v8, 0i64);
_InterlockedAnd64((volatile signed __int64 *)v8 + 3, 0x7FFFFFFFFFFFFFFFui64);
if( v60 )
return MiReducePteUseCount(v59, v60);
else
return HIDWORD(v69);
}
return v9;
}Referenced by:
MiDecommitPages
MiDeletePteWsleCluster