MiGetAweNode
MMPTE *__fastcall MiGetAweNode(UINT64 a1){
MMPTE *v1;
unsigned __int64 v2;
__int64 v3;
v1 = *(MMPTE **)(*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1680i64) + 400i64);
if( !v1 )
return 0i64;
v2 = a1 >> 12;
do
{
v3 = *((_QWORD *)v1 + 3);
if( v2 > (*(unsigned int *)(v3 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v3 + 33) << 32)) )
{
v1 = (MMPTE *)*((_QWORD *)v1 + 1);
}
else
{
if( v2 >= (*(unsigned int *)(v3 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v3 + 32) << 32)) )
break;
v1 = *(MMPTE **)v1;
}
}
while( v1 );
if( v1 )
return v1;
else
return 0i64;
}Referenced by:
MiGetAwePageSizeFromVa
MiProtectAweRegion
MiReferenceIncomingPhysicalPages
MiWriteAwePtes
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter