MiDeleteLargeUserPde

INT64 __fastcall MiDeleteLargeUserPde(INT64 a1, UINT64 a2, UINT64 a3){
  __int64 v3; 
  INT64 v4; 
  unsigned int v5; 
  int v7; 
  UNICODE_STRING *v8; 
  UINT8 v9; 
  WCHAR *v10; 
  unsigned __int64 v11; 
  INT64 v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  int v15; 
  unsigned __int64 i; 
  _MMPFN *UsedPtesHandle; 
  INT64 result; 
  INT64 v19; 
  INT64 v20; 
  __int64 v21; 
  __int64 v22; 
  char v23; 
  INT64 v24; 
  __int64 v25; 
  UINT64 SpinCount; 
  int v28; 
  v3 = *(_QWORD *)(a1 + 168);
  v4 = a1;
  v25 = v3;
  v5 = a3;
  v7 = *(_DWORD *)(v3 + 104);
  v28 = v7;
  v24 = MI_READ_PTE_LOCK_FREE(a2);
  v11 = v24;
  v12 = v24 & 1;
  if( (v24 & 1) != 0 )
  {
    v11 = MI_READ_PTE_LOCK_FREE((INT64)&v24);
  }
  else if( qword_140C4DC80 )
  {
    if( (v24 & 0x10) != 0 )
      v11 = v24 & 0xFFFFFFFFFFFFFFEFui64;
    else
      v11 = ~qword_140C4DC80 & v24;
  }
  v13 = (v11 >> 12) & 0xFFFFFFFFFi64;
  v14 = (-(__int64)(v5 != 0) & 0xFFFFFFFFFFFFFFF1ui64) + 16;
  v15 = v7 & 0x10;
  if( v15 )
  {
    MiDeleteVadAwePtes(*(_QWORD *)(*(_QWORD *)(v3 + 16) + 32i64), a2, (INT64 *)(v3 + 112));
    goto LABEL_18;
  }
  if( !v5 )
  {
    for( i = 0i64; i < v14; ++i )
      *(_QWORD *)(a2 + 8 * i) = ZeroPte;
LABEL_17:
    UsedPtesHandle = MiGetUsedPtesHandle((__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16);
    MiDecreaseUsedPtesCount(UsedPtesHandle, (unsigned int)v14);
    goto LABEL_18;
  }
  if( v12 )
  {
    MiRewritePteWithLockBit(*(_QWORD *)(v4 + 24), (volatile INT64 *)a2, ZeroPte);
  }
  else
  {
    *(_QWORD *)a2 = ZeroPte;
    v4 = a1;
  }
  if( v5 != 3 )
    goto LABEL_17;
LABEL_18:
  result = (INT64)MmGetPfnDb();
  v19 = result + 48 * v13;
  if( v12 )
  {
    v20 = *(_QWORD *)(v4 + 16);
    if( v5 )
      result = MiInsertLargeTbFlushEntry(v20, v5, a2);
    else
      result = MiInsertTbFlushEntry(v20, (__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16, v14, 0i64);
  }
  if( !v15 )
  {
    LOBYTE(result) = MI_PFN_IS_PROTO((UNICODE_STRING *)v19, v8, v9, v10);
    if( !(_DWORD)result )
    {
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)(v19 + 24), 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( *(__int64 *)(v19 + 24) < 0 );
      }
      v21 = v25;
      *(_BYTE *)(v19 + 34) = *(_BYTE *)(v19 + 34) & 0xF8 | 5;
      MiSetLeafPfnBuddy((_QWORD *)v19, *(_QWORD *)(*(_QWORD *)(v21 + 16) + 40i64));
      result = 0x7FFFFFFFFFFFFFFFi64;
      *(_QWORD *)(*(_QWORD *)(v22 + 16) + 40i64) = v19;
      *(_BYTE *)(v19 + 34) ^= (*(_BYTE *)(v19 + 34) ^ v23) & 7;
      _InterlockedAnd64((volatile signed __int64 *)(v19 + 24), 0x7FFFFFFFFFFFFFFFui64);
    }
  }
  if( (v28 & 0x800) != 0 && !v5 )
    *(_BYTE *)(v4 + 3) = 15;
  return result;
}

Referenced by: