MmReadProcessPageTables

INT64 __fastcall MmReadProcessPageTables(
        VOID *DllHandle,
        const UINT64 *ResourceIdPath,
        UINT64 ResourceIdPathLength,
        _IMAGE_RESOURCE_DATA_ENTRY **ResourceDataEntry){
  UINT64 ValidPte; 
  struct _KPRCB *CurrentPrcb; 
  __int64 v6; 
  INT64 result; 
  unsigned int v8; 
  unsigned __int64 v9; 
  volatile __int64 *v10; 
  __int64 v11; 
  UINT8 *v12; 
  _MMPFN *PfnDb; 
  _MMPTE *PteLimit; 
  __int64 v15; 
  char *v16; 
  char *v17; 
  unsigned __int64 v18; 
  unsigned __int64 PteBase; 
  unsigned __int64 v20; 
  unsigned __int64 v21; 
  unsigned __int64 v22; 
  __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  ValidPte = MiMakeValidPte(0i64, 0i64, 2684354564i64);
  CurrentPrcb = KeGetCurrentPrcb();
  v6 = ValidPte;
  __wbinvd();
  LODWORD(result) = ExTryAcquireSpinLockSharedAtDpcLevel((INT64 *)&dword_140C50B88);
  v8 = 0;
  if( (_DWORD)result )
  {
    v9 = *((_QWORD *)CurrentPrcb + 4160) & 0xFFFFFFFFFFFFF000ui64;
    v10 = (volatile __int64 *)((char *)MmGetPteBase() + ((v9 >> 9) & 0x7FFFFFFFF8i64));
    v11 = _InterlockedExchange64(v10, ZeroPte);
    KeFlushSingleCurrentTb((PVOID)v9);
    v12 = MmPhysicalMemoryBlock;
    if( *(_DWORD *)MmPhysicalMemoryBlock )
    {
      PfnDb = MmGetPfnDb();
      PteLimit = MmGetPteLimit();
      do
      {
        v15 = *(_QWORD *)&v12[16 * v8 + 16];
        v16 = (char *)PfnDb + 48 * v15;
        v17 = (char *)PfnDb + 48 * v15 + 48 * *(_QWORD *)&v12[16 * v8 + 24];
        if( v16 < v17 )
        {
          do
          {
            if( (v16[34] & 7) == 6 )
            {
              v18 = *((_QWORD *)v16 + 1) | 0x8000000000000000ui64;
              PteBase = (unsigned __int64)MmGetPteBase();
              if( v18 >= PteBase && v18 <= (unsigned __int64)PteLimit )
              {
                v20 = (__int64)((v18 << 25) - (PteBase << 25)) >> 16;
                if( v20 >= PteBase && v20 <= (unsigned __int64)PteLimit )
                {
                  v21 = *((_QWORD *)v16 + 5);
                  if( ((v21 >> 60) & 7) != 1
                    && (v21 & 0x1000000000i64) == 0
                    && (v21 & 0xFFFFFFFFFi64) != 0xFFFFFFFFDi64
                    && (v16[34] & 0xC0) == 64 )
                  {
                    v6 ^= (v6 ^ (((v16 - (char *)MmGetPfnDb()) / 48) << 12)) & 0xFFFFFFFFF000i64;
                    _InterlockedExchange64(v10, v6);
                    KeFlushSingleCurrentTb((PVOID)v9);
                    v22 = v9;
                    v23 = 64i64;
                    do
                    {
                      v22 += 64i64;
                      --v23;
                    }
                    while( v23 );
                    v24 = KiCacheErrataMonitor;
                    v25 = *((unsigned int *)CurrentPrcb + 9) + 16i64;
                    *((_DWORD *)CurrentPrcb + 7928) = 1;
                    _InterlockedExchange64((volatile __int64 *)(v24 + 16 * v25), -1i64);
                    if( (*(_QWORD *)(v24 + 16 * (*((unsigned int *)DllHandle + 9) + 16i64)) & *((_QWORD *)CurrentPrcb
                                                                                               + 25)) != 0i64 )
                      goto LABEL_21;
                    PteLimit = MmGetPteLimit();
                  }
                }
              }
            }
            v16 += 48;
          }
          while( v16 < v17 );
          PfnDb = MmGetPfnDb();
        }
        v12 = MmPhysicalMemoryBlock;
        ++v8;
      }
      while( v8 < *(_DWORD *)MmPhysicalMemoryBlock );
    }
LABEL_21:
    _InterlockedExchange64(v10, v11);
    KeFlushSingleCurrentTb((PVOID)v9);
    ExReleaseSpinLockSharedFromDpcLevel(&dword_140C50B88);
    return 1i64;
  }
  return result;
}

Referenced by: