MiGetWorkingSetInfoList
INT64 __stdcall MiGetWorkingSetInfoList(PVOID rcx0, INT64 edx0, INT64 r8, UINT64 r9){
int v6;
UINT64 v8;
_ETHREAD *CurrentThread;
struct _MDL *v10;
struct _MDL *v11;
char v12;
UINT8 *MappedSystemVa;
ULONG_PTR v14;
INT64 v15;
INT64 v16;
UINT8 v17;
UINT64 v18;
MMPTE *v19;
int v20;
__int64 v21;
UINT64 v22;
unsigned __int64 v23;
unsigned int v24;
UINT64 v25;
unsigned int v26;
unsigned int v27;
_MMPTE *PteBase;
unsigned __int64 v29;
char v30;
_MMPTE *v31;
unsigned __int64 v32;
unsigned __int64 v33;
INT64 v34;
UINT64 v35;
__int64 v36;
int v37;
int v38;
unsigned __int64 i;
__int64 v40;
UINT64 j;
UNICODE_STRING *v42;
INT64 v43;
_MMPFN *v44;
__int64 v45;
ULONG_PTR v46;
_MMPTE *ProtoPteAddress;
__int64 v48;
_MMPFN *v49;
INT64 v50;
INT64 v51;
int PagingFileOffset;
int v53;
unsigned __int64 v54;
char *v55;
__int64 v56;
__int16 v57;
int v58;
int v59;
char PfnPriority;
__int64 v61;
__int64 v62;
__int64 v63;
WCHAR *PfnDb;
INT64 v65;
UNICODE_STRING *v66;
unsigned __int64 v67;
UINT8 v68;
INT64 v69;
char v70;
__int64 v71;
__int64 v72;
__int64 v73;
UINT8 v74;
WCHAR *v75;
char v76;
INT64 v77;
unsigned __int64 v78;
unsigned __int64 v79;
int v80;
_QWORD *v81;
unsigned __int64 v82;
unsigned __int64 v83;
int ValidAweProtection;
INT16 v85;
unsigned __int64 v86;
UNICODE_STRING *v87;
UINT8 v88;
WCHAR *v89;
int v90;
unsigned __int64 v91;
unsigned __int64 v92;
__int64 v93;
_MMPTE *v94;
bool v95;
UINT64 v96;
void *v97;
unsigned __int64 v98;
UINT8 v99;
int v100;
__int64 v101;
__int64 v102;
char v103;
PVOID v104;
UINT8 WsIrql;
INT64 v106;
_MMPTE *v107;
MMPTE *LastProtoPte;
ULONG_PTR BugCheckParameter2;
UINT64 v110;
UINT8 *v111;
UINT64 v112;
_MMPTE *v113;
INT64 v114;
INT64 v115;
UINT8 IgnoreCase[8];
INT64 v117;
__int64 v118;
ULONG_PTR BugCheckParameter1;
UINT8 *v120;
INT64 *v121;
PVOID P;
MMPTE *PointerPte;
UINT8 *dst;
PVOID v125;
INT64 v126;
_SUBSECTION *ContainingSubsection;
UINT64 Vpn;
__int64 v129;
_KAPC_STATE ApcState;
UINT8 Src[128];
int v132;
v132 = edx0;
dst = (UINT8 *)r8;
BugCheckParameter1 = (ULONG_PTR)rcx0;
v125 = rcx0;
v126 = r8;
v117 = 0i64;
v121 = 0i64;
memset(&ApcState, 0, sizeof(ApcState));
v6 = 0;
if( r9 > 0xFFFFFFFF )
return 3221225990i64;
v8 = r9 >> 4;
v110 = r9 >> 4;
if( !(r9 >> 4) )
return 3221225476i64;
if( (edx0 & 0x3FFFFFFC) != 0 || (edx0 & 3) == 3 )
return 3221225485i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( v8 <= 8 )
{
memmove(Src, (UINT8 *)r8, 16 * v8);
P = 0i64;
MappedSystemVa = Src;
v111 = Src;
v120 = Src;
}
else
{
LODWORD(v10) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
v11 = v10;
P = v10;
if( !v10 )
return 3221225626i64;
v10->Next = 0i64;
v10->Size = 8 * ((((r8 & 0xFFF) + r9 + 4095) >> 12) + 6);
v10->MdlFlags = 0;
v10->StartVa = (void *)(r8 & 0xFFFFFFFFFFFFF000ui64);
v10->ByteOffset = r8 & 0xFFF;
v10->ByteCount = r9;
v12 = *((_BYTE *)CurrentThread + 562);
MiProbeAndLockPages((INT64)v10, v12 != 0, 1i64);
if( (v11->MdlFlags & 5) != 0 )
MappedSystemVa = (UINT8 *)v11->MappedSystemVa;
else
MappedSystemVa = (UINT8 *)MmMapLockedPagesSpecifyCache(v11, 0, MmCached, 0i64, 0, 0x40000010u);
v120 = MappedSystemVa;
v111 = MappedSystemVa;
if( !MappedSystemVa )
{
MmUnlockPages(v11);
ExFreePoolWithTag(v11, 0);
return 3221225626i64;
}
}
v14 = BugCheckParameter1;
if( *((_QWORD *)CurrentThread + 23) != BugCheckParameter1 )
{
KiStackAttachProcess((_KPROCESS *)BugCheckParameter1, 0i64, &ApcState);
v6 = 1;
v14 = BugCheckParameter1;
}
v15 = 0i64;
BugCheckParameter2 = 0i64;
v16 = v14 + 1664;
v106 = v14 + 1664;
v17 = 17;
WsIrql = 17;
v18 = 0i64;
v107 = 0i64;
v19 = 0i64;
LastProtoPte = 0i64;
LODWORD(v114) = 0;
v20 = v132;
do
{
v21 = 0i64;
v118 = 0i64;
v6 &= ~4u;
v22 = *(_QWORD *)MappedSystemVa;
v112 = *(_QWORD *)MappedSystemVa;
if( *(_QWORD *)MappedSystemVa > 0x7FFFFFFEFFFFui64 )
goto LABEL_204;
v23 = v22 >> 12;
Vpn = v22 >> 12;
if( !v15 )
goto LABEL_230;
if( v23 < (*(unsigned int *)(v15 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 32) << 32))
|| v23 > (*(unsigned int *)(v15 + 28) | ((unsigned __int64)*(unsigned __int8 *)(v15 + 33) << 32)) )
{
if( v19 )
{
MiLockProtoPage(0i64, v19, v17);
LastProtoPte = 0i64;
v17 = WsIrql;
v16 = v106;
}
if( v17 != 17 )
{
if( v18 )
{
MiUnlockPageTableInternal(v16, v18);
v18 = 0i64;
v107 = 0i64;
v17 = WsIrql;
}
MiUnlockWorkingSetShared(v106, v17);
WsIrql = 17;
}
MiUnlockAndDereferenceVadShared((PVOID)v15);
v15 = 0i64;
BugCheckParameter2 = 0i64;
}
v22 = v112;
if( !v15 )
{
LABEL_230:
v15 = MiObtainReferencedVadEx(v22, 2, &v114);
BugCheckParameter2 = v15;
if( !v15 )
{
v24 = v114;
if( (_DWORD)v114 == -1073741558 )
goto LABEL_213;
LABEL_201:
v18 = (UINT64)v107;
goto LABEL_202;
}
}
v25 = v112;
if( ((v112 & 0xFFFFFFFFFFFFF000ui64) == 2147352576
|| (v112 & 0xFFFFFFFFFFFFF000ui64) == qword_140C4DB88 && qword_140C4DB88)
&& (*(_DWORD *)(BugCheckParameter1 + 2172) & 1) == 0 )
{
v6 |= 4u;
}
if( (*(_DWORD *)(v15 + 48) & 0x70) == 16 )
{
v21 = (16i64 * (MmProtectToValue[((unsigned __int64)*(unsigned int *)(v15 + 48) >> 7) & 0x1F] & 0x7FF)) | 0x400001;
LABEL_202:
v19 = LastProtoPte;
v16 = v106;
LABEL_203:
v17 = WsIrql;
v20 = v132;
LABEL_204:
v96 = v110;
goto LABEL_205;
}
LABEL_41:
v6 &= ~2u;
v26 = *(_DWORD *)(v15 + 48);
if( (v26 & 0x100000) != 0 && ((v27 = (v26 >> 18) & 3, (v26 & 0x400000) != 0) || v27 >= 2) && v27 >= 2
|| (*(_DWORD *)(v15 + 48) & 0x100000) == 0 && (*(_DWORD *)(v15 + 64) & 0x1000000) != 0 )
{
v6 |= 2u;
}
if( (v6 & 2) != 0 && WsIrql != 17 )
{
if( v18 )
{
MiUnlockPageTableInternal(v106, v18);
v18 = 0i64;
v107 = 0i64;
}
MiUnlockWorkingSetShared(v106, WsIrql);
WsIrql = 17;
v25 = v112;
}
PteBase = MmGetPteBase();
v29 = (unsigned __int64)PteBase + ((v25 >> 9) & 0x7FFFFFFFF8i64);
PointerPte = (MMPTE *)v29;
v30 = WsIrql;
if( WsIrql != 17 )
{
if( (((_BYTE)v29 + 8) & 0x78) == 0 && MiWorkingSetIsContended(v106) || KeShouldYieldProcessor() )
{
if( v18 )
{
MiUnlockPageTableInternal(v106, v18);
v18 = 0i64;
v107 = 0i64;
}
MiUnlockWorkingSetShared(v106, WsIrql);
v30 = 17;
WsIrql = 17;
}
else
{
v30 = WsIrql;
}
}
v31 = (_MMPTE *)((char *)PteBase + ((v29 >> 9) & 0x7FFFFFFFF8i64));
v113 = v31;
while( 1 )
{
if( v30 == 17 )
WsIrql = MiLockWorkingSetShared(v106);
v32 = -1i64;
*(_QWORD *)IgnoreCase = -1i64;
v21 = 0i64;
v118 = 0i64;
if( (_MMPTE *)v18 == v31 )
{
v33 = v29;
v121 = (INT64 *)v29;
}
else
{
if( v18 )
MiUnlockPageTableInternal(v106, v18);
v107 = MiLockLowestValidPageTable(v106, (INT64 *)v29, &v121);
v33 = (unsigned __int64)v121;
}
v34 = MI_READ_PTE_LOCK_FREE(v33);
v35 = v34;
v115 = v34;
if( !v34 )
{
v36 = 0i64;
v37 = v6 & 2;
if( (v6 & 2) == 0 )
goto LABEL_101;
goto LABEL_86;
}
if( (v34 & 1) == 0 || (v34 & 0x80u) == 0i64 )
{
if( v107 != v113 )
{
if( (unsigned int)MiWorkingSetInfoCheckPageTable(v106, v33, (INT64)&v117, v132, WsIrql) == 1 )
{
v18 = 0i64;
v107 = 0i64;
goto LABEL_83;
}
v21 = v118;
}
v37 = v6 & 2;
LABEL_86:
v25 = v112;
goto LABEL_87;
}
v32 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v115) >> 12) & 0xFFFFFFFFFi64;
*(_QWORD *)IgnoreCase = v32;
v38 = -1;
for( i = (unsigned __int64)MmGetPteBase(); v33 >= i; ++v38 )
{
if( v33 > (unsigned __int64)MmGetPteLimit() )
break;
v33 = (__int64)((v33 << 25) - (i << 25)) >> 16;
}
v40 = 1i64;
v25 = v112;
for( j = v112 >> 12; v38; --v38 )
{
v32 += v40 * (j & 0x1FF);
j >>= 9;
v40 <<= 9;
}
v21 = 8388609i64;
v118 = 8388609i64;
v37 = v6 & 2;
LABEL_87:
v42 = *(UNICODE_STRING **)IgnoreCase;
if( *(_QWORD *)IgnoreCase != -1i64 )
goto LABEL_156;
if( v37 )
{
v15 = BugCheckParameter2;
v18 = (UINT64)v107;
goto LABEL_41;
}
v18 = (UINT64)v107;
if( v107 != (_MMPTE *)((char *)MmGetPdeBase() + ((v25 >> 18) & 0x3FFFFFF8)) )
{
v15 = BugCheckParameter2;
goto LABEL_98;
}
v43 = MI_READ_PTE_LOCK_FREE(v29);
v35 = v43;
v115 = v43;
if( (v43 & 1) != 0 )
break;
v36 = v43;
if( (v43 & 0x400) != 0 )
{
v46 = BugCheckParameter2;
goto LABEL_105;
}
if( (v43 & 0x800) == 0 )
{
if( (unsigned int)MiGetPagingFileOffset((MMPTE *)&v115) )
{
v21 = v21 & 0xFFFFFFFFFF3FFFFFui64 | 0x800000;
goto LABEL_96;
}
if( v35 )
goto LABEL_96;
LABEL_101:
v46 = BugCheckParameter2;
if( (v6 & 4) == 0 && (*(_DWORD *)(BugCheckParameter2 + 48) & 0x100000) != 0 )
{
v15 = BugCheckParameter2;
goto LABEL_97;
}
LABEL_105:
ProtoPteAddress = 0i64;
if( (v6 & 4) != 0 )
{
ProtoPteAddress = (_MMPTE *)qword_140C4DB80;
if( (v112 & 0xFFFFFFFFFFFFF000ui64) == 2147352576 )
ProtoPteAddress = (_MMPTE *)ProtoPte;
goto LABEL_108;
}
if( (*(_DWORD *)(v46 + 48) & 0x100000) != 0 )
{
if( !qword_140C4DC80 )
goto LABEL_119;
if( (v36 & 0x10) == 0 )
{
v36 &= ~qword_140C4DC80;
goto LABEL_119;
}
}
else
{
ProtoPteAddress = MiGetProtoPteAddress((_MMVAD *)v46, v112 >> 12, 0i64, &ContainingSubsection);
if( !v36 || MiIsPrototypePteVadLookup(v35) )
{
LABEL_108:
v48 = (__int64)ProtoPteAddress;
LABEL_120:
if( !v48 )
goto LABEL_96;
v21 |= 0x8000ui64;
v118 = v21;
if( (_MMPTE *)v48 == ProtoPteAddress )
{
v21 |= 0x40000000ui64;
v118 = v21;
}
if( ((v48 ^ (unsigned __int64)LastProtoPte) & 0xFFFFFFFFFFFFF000ui64) == 0 )
{
v49 = MiLockLeafPage((_MMPTE *)v48, 0i64);
v50 = MI_READ_PTE_LOCK_FREE(v48);
v51 = v50;
v115 = v50;
if( v49 )
{
MiQueryPfn((v49 - MmGetPfnDb()) / 48, (INT64)&v117);
_InterlockedAnd64((volatile signed __int64 *)v49 + 3, 0x7FFFFFFFFFFFFFFFui64);
LABEL_95:
v21 = v118;
LABEL_96:
v15 = BugCheckParameter2;
LABEL_97:
v18 = (UINT64)v107;
LABEL_98:
MappedSystemVa = v111;
goto LABEL_202;
}
if( (v50 & 0x400) != 0 || (v50 & 0x800) != 0 || !MiInvalidPteConforms(v50) )
goto LABEL_96;
PagingFileOffset = MiGetPagingFileOffset((MMPTE *)&v115);
MappedSystemVa = v111;
v15 = BugCheckParameter2;
v17 = WsIrql;
v16 = v106;
v19 = LastProtoPte;
v20 = v132;
if( PagingFileOffset )
v21 = v21 & 0xFFFFFFFFFF3FFFFFui64 | 0x800000;
else
v21 &= -(__int64)(v51 != 0);
v18 = (UINT64)v107;
goto LABEL_204;
}
if( v107 )
{
MiUnlockPageTableInternal(v106, (UINT64)v107);
v107 = 0i64;
}
LastProtoPte = MiLockProtoPage((MMPTE *)v48, LastProtoPte, WsIrql);
goto LABEL_127;
}
if( !qword_140C4DC80 )
{
LABEL_119:
v48 = v36 >> 16;
goto LABEL_120;
}
if( (v36 & 0x10) == 0 )
{
v36 &= ~qword_140C4DC80;
goto LABEL_119;
}
}
v36 &= ~0x10ui64;
goto LABEL_119;
}
v44 = MiLockTransitionLeafPage((_MMPTE *)v29, 0i64);
if( v44 )
{
MiQueryPfn((v44 - MmGetPfnDb()) / 48, (INT64)&v117);
_InterlockedAnd64((volatile signed __int64 *)(v45 + 24), 0x7FFFFFFFFFFFFFFFui64);
goto LABEL_95;
}
LABEL_127:
v18 = (UINT64)v107;
LABEL_83:
v31 = v113;
v30 = WsIrql;
}
v21 |= 1ui64;
v53 = *(_DWORD *)(BugCheckParameter2 + 48);
if( (v53 & 0x70) == 64 )
{
v54 = MI_READ_PTE_LOCK_FREE((INT64)&v115);
v55 = (char *)MmGetPfnDb() + 48 * ((v54 >> 12) & 0xFFFFFFFFFi64);
v56 = v21;
if( ((*((_QWORD *)MmGetPfnDb() + 6 * ((v54 >> 12) & 0xFFFFFFFFFi64) + 5) >> 50) & 1) != 0 )
{
v57 = v35;
if( (v55[35] & 0x40) != 0 || MiIsPageOnBadList((INT64)v55) )
{
v21 |= 0x80000000ui64;
LOWORD(v35) = v57;
v56 = v21;
}
}
if( (unsigned int)MiRotatedToFrameBuffer(PointerPte) )
{
v58 = (v35 & 0x800) != 0 ? 4 : 1;
v59 = v53 & 0xC00;
if( v59 == 3072 && (v53 & 0x380) != 0 )
{
v58 |= 0x18u;
}
else if( v59 == 1024 )
{
v58 |= 8u;
}
}
else
{
PfnPriority = MiGetPfnPriority((INT64)v55);
LODWORD(v61) = MiSearchNumaNodeTable((PVOID)((v55 - (char *)MmGetPfnDb()) / 48));
v21 = v56 & 0xFFFFFFFFF8C0FFFFui64 | ((*(_DWORD *)(v61 + 8) & 0x3F | ((unsigned __int64)(PfnPriority & 7) << 8)) << 16);
v58 = (*((_DWORD *)v55 + 4) >> 5) & 0x1F;
if( (*((_QWORD *)v55 + 5) & 0x1000000000i64) == 0 && *((__int64 *)v55 + 1) > 0 )
{
v62 = v21 | 0x8000;
LOBYTE(v63) = 7;
if( (*((_QWORD *)v55 + 3) & 0x3FFFFFFFFFFFFFFFui64) < 7 )
v63 = *((_QWORD *)v55 + 3) & 0x3FFFFFFFFFFFFFFFi64;
v21 = v62 ^ ((unsigned __int8)v62 ^ (unsigned __int8)(2 * v63)) & 0xE;
v58 = MmMakeProtectNotWriteCopy[v58];
}
}
v21 = ((unsigned __int16)v21 ^ (unsigned __int16)(16 * MmProtectToValue[v58])) & 0x7FF0 ^ (unsigned __int64)v21;
goto LABEL_96;
}
v32 = ((unsigned __int64)MI_READ_PTE_LOCK_FREE((INT64)&v115) >> 12) & 0xFFFFFFFFFi64;
v42 = *(UNICODE_STRING **)IgnoreCase;
LABEL_156:
PointerPte = (MMPTE *)(48 * v32);
PfnDb = (WCHAR *)MmGetPfnDb();
v65 = (INT64)&PfnDb[24 * v32];
v66 = (UNICODE_STRING *)v65;
*(_QWORD *)IgnoreCase = v65;
if( (*(_QWORD *)(v65 + 40) & 0x1000000000i64) != 0 )
{
v67 = v32 & 0xFFFFFFFFFFFFFFF0ui64;
if( v42 != (UNICODE_STRING *)-1i64 )
v67 = (unsigned __int64)v42;
v66 = (UNICODE_STRING *)&PfnDb[24 * v67];
*(_QWORD *)IgnoreCase = v66;
}
v68 = MI_PFN_IS_PROTO(v66, v66, (UINT8)v42, PfnDb);
v70 = MiGetPfnPriority(v69);
LODWORD(v73) = MiSearchNumaNodeTable((PVOID)((v71 - v72) / 48));
v76 = 7;
v77 = *(_DWORD *)(v73 + 8) & 0x3F;
v78 = v21 & 0xFFFFFFFFF8C07FFFui64 | ((v68 & 1 | (2 * (v77 | ((unsigned __int64)(v70 & 7) << 8)))) << 15);
if( (*(_BYTE *)(v65 + 35) & 0x40) != 0 || MiIsPageOnBadList(v65) )
v78 |= 0x80000000ui64;
if( (v78 & 0x800000) != 0 || (v79 = *(_QWORD *)(v65 + 40), (v79 & 0x1000000000i64) != 0) )
{
LABEL_193:
v97 = (void *)v35;
v15 = BugCheckParameter2;
v98 = v78 ^ ((unsigned __int16)v78 ^ (unsigned __int16)(16
* MmProtectToValue[MiGetProtectionFromPte(
(PVOID)BugCheckParameter2,
v97)])) & 0x7FF0;
if( (*(_DWORD *)(BugCheckParameter2 + 48) & 0x1100000) == 17825792 )
v98 &= 0xFFFFFFF0FFFFFFFFui64;
v21 = v98 | 0x400000;
LOBYTE(v100) = MI_PFN_IS_PROTO(*(UNICODE_STRING **)IgnoreCase, (UNICODE_STRING *)v21, v99, (PWCHAR)0x1100000);
MappedSystemVa = v111;
v18 = (UINT64)v107;
v16 = v106;
v19 = LastProtoPte;
if( v100 )
{
v103 = 7;
if( (*(_QWORD *)(v102 + 24) & 0x3FFFFFFFFFFFFFFFui64) < 7 )
v103 = *(_BYTE *)(v102 + 24);
v21 = v101 & 0xFFFFFFFFFFFFFFF1ui64 | (2 * (v103 & 7 | 0x20000000i64));
}
goto LABEL_203;
}
if( (*(_QWORD *)&v76 & (v79 >> 60)) == 1 )
{
LOBYTE(v80) = MI_PFN_IS_PROTO((UNICODE_STRING *)v65, (UNICODE_STRING *)1, v74, v75);
if( !v80 )
{
v81 = (_QWORD *)qword_140C4EBC0;
if( !qword_140C4EBC0 )
goto LABEL_177;
v82 = (__int64)PointerPte / 48;
v129 = (__int64)PointerPte / 48;
while( v81 )
{
v83 = v81[3];
if( v82 < v83 )
{
v81 = (_QWORD *)*v81;
}
else
{
if( v82 - v83 < v81[4] )
break;
v81 = (_QWORD *)v81[1];
}
}
if( v81 )
{
ValidAweProtection = (*(_DWORD *)(v65 + 16) >> 5) & 0x1F;
v15 = BugCheckParameter2;
}
else
{
LABEL_177:
v85 = v35;
v15 = BugCheckParameter2;
ValidAweProtection = MiGetValidAweProtection(BugCheckParameter2, v85);
}
v86 = v78 ^ ((unsigned __int16)v78 ^ (unsigned __int16)(16 * MmProtectToValue[ValidAweProtection])) & 0x7FF0;
if( (*(_DWORD *)(v15 + 48) & 0x1100000) == 17825792 )
v86 &= 0xFFFFFFF0FFFFFFFFui64;
v21 = v86 | 0x400000;
goto LABEL_97;
}
goto LABEL_193;
}
if( (MiGetWsleContents(v77, v112) & 0xF) == 8 )
v78 |= 0x400000ui64;
LOBYTE(v90) = MI_PFN_IS_PROTO((UNICODE_STRING *)v65, v87, v88, v89);
if( !v90 )
{
v21 = v78 & 0xFFFFFFFFFFFF8001ui64 | (16i64 * (MmProtectToValue[(*(_DWORD *)(v65 + 16) >> 5) & 0x1F] & 0x7FF));
v15 = BugCheckParameter2;
MappedSystemVa = v111;
v18 = (UINT64)v107;
v17 = WsIrql;
v16 = v106;
v19 = LastProtoPte;
v20 = v132;
if( (*(_DWORD *)(BugCheckParameter2 + 48) & 0x1100000) == 17825792 )
v21 &= 0xFFFFFFF0FFFFFFFFui64;
goto LABEL_204;
}
LOBYTE(v93) = v92;
if( (*(_QWORD *)(v65 + 24) & 0x3FFFFFFFFFFFFFFFui64) < v92 )
v93 = *(_QWORD *)(v65 + 24) & 0x3FFFFFFFFFFFFFFFi64;
v21 = v78 & 0xFFFFFFFFFFFF8001ui64 | (2
* (v93 & 7 | (8i64
* (MmProtectToValue[(unsigned int)MiGetPfnProtection(
0x3FFFFFFFFFFFFFFFi64,
v91,
v65)] & 0x7FF))));
v15 = BugCheckParameter2;
if( (v6 & 4) != 0 )
{
v21 |= 0x40000000ui64;
goto LABEL_97;
}
if( (*(_DWORD *)(BugCheckParameter2 + 48) & 0x100000) != 0 )
{
MappedSystemVa = v111;
goto LABEL_201;
}
v94 = MiGetProtoPteAddress((_MMVAD *)BugCheckParameter2, Vpn, 0i64, &ContainingSubsection);
MappedSystemVa = v111;
v18 = (UINT64)v107;
v17 = WsIrql;
v16 = v106;
v19 = LastProtoPte;
v95 = v94 == (_MMPTE *)(*(_QWORD *)(v65 + 8) | 0x8000000000000000ui64);
v96 = v110;
v20 = v132;
if( v95 )
v21 |= 0x40000000ui64;
LABEL_205:
if( (v20 & 0x40000000) != 0 )
{
if( (v21 & 1) != 0 )
{
if( (v21 & 0x40000000) != 0 )
v21 = v21 & 0xFFFFFFFFF8C0FFF1ui64 | 0xE;
}
else if( (v21 & 0x40000000) != 0 )
{
v21 &= 0xFFFFFFFFF03FFFFFui64;
}
}
*((_QWORD *)MappedSystemVa + 1) = v21;
MappedSystemVa += 16;
v111 = MappedSystemVa;
v120 = MappedSystemVa;
v110 = v96 - 1;
}
while( v96 != 1 );
v24 = 0;
LABEL_213:
if( WsIrql != 17 )
{
if( v107 )
MiUnlockPageTableInternal(v106, (UINT64)v107);
MiUnlockWorkingSetShared(v106, WsIrql);
}
if( LastProtoPte )
MiLockProtoPage(0i64, LastProtoPte, 0x11u);
if( v15 )
MiUnlockAndDereferenceVadShared((PVOID)v15);
if( (v6 & 1) != 0 )
KiUnstackDetachProcess(&ApcState, 0i64);
v104 = P;
if( P )
{
MmUnlockPages((_MDL *)P);
ExFreePoolWithTag(v104, 0);
}
else
{
memmove(dst, Src, (MappedSystemVa - Src) & 0xFFFFFFFFFFFFFFF0ui64);
}
return v24;
}Referenced by:
MmQueryVirtualMemory