MiCapturePfnVm

_MMSUPPORT_FULL *__fastcall MiCapturePfnVm(
        _MI_PAGE_COMBINING_SUPPORT *Pcs,
        _MMPFN *LeafPfn,
        VOID **ReferencedObject,
        _MMPTE **CapturedPte,
        UINT *CapturedProtection){
  unsigned int v6; 
  _QWORD *v7; 
  int *v9; 
  _MI_PARTITION *Partition; 
  unsigned __int8 CurrentIrql; 
  unsigned int v12; 
  int v13; 
  UINT64 TopLevelPfn; 
  _DWORD *v15; 
  _MMSUPPORT_FULL *AnyMultiplexedVm; 
  unsigned int v17; 
  INT64 CombineDomain; 
  _EPROCESS *v20; 
  int v21; 
  UINT64 SpinCount; 
  int *v23; 
  INT64 *v24; 
  v6 = (unsigned int)ReferencedObject;
  v7 = (_QWORD *)SpinCount;
  v9 = v23;
  Partition = Pcs->Partition;
  *(_QWORD *)CapturedProtection = 0i64;
  *v7 = 0i64;
  *v9 = 24;
  if( MiHashIsCommon((INT64)Pcs, (INT64)CapturedPte, 0i64) )
  {
    v21 = 1;
    *v24 = qword_140C4E290;
  }
  else
  {
    v21 = 0;
  }
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  LODWORD(SpinCount) = 0;
  while( _interlockedbittestandset64((volatile signed __int32 *)LeafPfn + 6, 0x3Fui64) )
  {
    do
      KeYieldProcessorEx(&SpinCount);
    while( *((__int64 *)LeafPfn + 3) < 0 );
  }
  v12 = MiCombineCandidate((_MI_PAGE_COMBINING_SUPPORT *)Partition, (_MMPFN *)v6);
  if( !v12 )
  {
    _InterlockedAnd64((volatile signed __int64 *)LeafPfn + 3, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(CurrentIrql);
    return 0i64;
  }
  v13 = (*((_DWORD *)LeafPfn + 4) >> 5) & 0x1F;
  *v7 = *((_QWORD *)LeafPfn + 1) | 0x8000000000000000ui64;
  *v9 = v13;
  if( v12 == 1 )
  {
    TopLevelPfn = MiGetTopLevelPfn((UINT64)LeafPfn);
    v15 = (_DWORD *)((*(_QWORD *)TopLevelPfn >> 13) & 0x7FFFFFFFFFF0i64 | 0xFFFF800000000000ui64);
    AnyMultiplexedVm = (_MMSUPPORT_FULL *)(v15 + 416);
    if( (unsigned int)MiIsStoreProcess((__int64)v15) )
      AnyMultiplexedVm = 0i64;
    if( (v15[629] & 0x1000) != 0 && !v21 )
      AnyMultiplexedVm = 0i64;
    if( ObReferenceObjectSafeWithTag(v15, 0x746C6644ui64) )
      *(_QWORD *)CapturedProtection = v15;
    else
      AnyMultiplexedVm = 0i64;
    if( (_MMPFN *)TopLevelPfn != LeafPfn )
      _InterlockedAnd64((volatile signed __int64 *)(TopLevelPfn + 24), 0x7FFFFFFFFFFFFFFFui64);
    goto LABEL_13;
  }
  if( !v21 )
  {
LABEL_23:
    AnyMultiplexedVm = 0i64;
    goto LABEL_13;
  }
  if( v12 != 2 )
  {
    v20 = MiReferenceOwningSession((ULONG_PTR)LeafPfn);
    if( v20 )
    {
      AnyMultiplexedVm = (_MMSUPPORT_FULL *)(*((_QWORD *)v20 + 171) + 256i64);
      *(_QWORD *)CapturedProtection = v20;
      goto LABEL_13;
    }
    goto LABEL_23;
  }
  AnyMultiplexedVm = (_MMSUPPORT_FULL *)MiGetAnyMultiplexedVm(2i64);
LABEL_13:
  _InterlockedAnd64((volatile signed __int64 *)LeafPfn + 3, 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(CurrentIrql);
  if( AnyMultiplexedVm )
  {
    v17 = v21;
    if( !v21 )
    {
      CombineDomain = MiGetCombineDomain(v12, (INT64)AnyMultiplexedVm);
      *v24 = CombineDomain;
      v17 = 0;
    }
    if( v12 == 1
      && *(_QWORD *)(*(_QWORD *)CapturedProtection + 2288i64)
      && !VmCheckPageCombine(*(_QWORD *)CapturedProtection, v17) )
    {
      return 0i64;
    }
  }
  return AnyMultiplexedVm;
}

Referenced by: