MiLargePageFault

NTSTATUS __stdcall MiLargePageFault(UINT64 FaultStatus, PVOID VirtualAddress, PVOID TrapInformation, INT8 PreviousMode){
  unsigned __int64 PteBase; 
  unsigned int v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  signed __int64 v10; 
  __int64 v11; 
  INT64 v12; 
  UINT64 v13; 
  UINT64 v14; 
  INT64 v15; 
  __int64 v16; 
  _BYTE *v17; 
  unsigned __int64 v18; 
  _QWORD *VirtualFaultPageInfo; 
  __int64 v20; 
  unsigned __int64 v21; 
  __int64 i; 
  __int16 v23; 
  __int64 v24; 
  UINT64 v26[2]; 
  int result; 
  __int16 result_4; 
  int v29; 
  __int64 v30; 
  __int64 v31; 
  memset((INT64)&result, 0i64);
  PteBase = (unsigned __int64)MmGetPteBase();
  v7 = 1;
  v8 = 0x200000i64;
  v9 = (__int64)(((__int64)(((_QWORD)VirtualAddress << 25) - (PteBase << 25)) >> 16 << 25) - (PteBase << 25)) >> 16;
  while( v9 >= PteBase && v9 <= (unsigned __int64)MmGetPteLimit() )
  {
    ++v7;
    v9 = (__int64)((v9 << 25) - (PteBase << 25)) >> 16;
    v8 <<= 9;
  }
  v10 = MI_READ_PTE_LOCK_FREE((INT64)VirtualAddress);
  v11 = *(_QWORD *)(FaultStatus + 16);
  v12 = v10;
  v26[0] = v10;
  if( (v11 & 1) != 0 && *(_BYTE *)(v11 & 0xFFFFFFFFFFFFFFFEui64) == 1 )
    return 0;
  if( (*(_DWORD *)(FaultStatus + 80) & 0x20) == 0 )
  {
    if( (*(_BYTE *)(FaultStatus + 8) & 2) != 0 )
    {
      if( (v10 & 0x800) == 0 )
        return -1073741819;
      if( (unsigned int)MiNoFaultFound(
                           FaultStatus,
                           (volatile signed __int64 *)VirtualAddress,
                           *(_QWORD *)FaultStatus,
                           v11,
                           0,
                           v10) )
      {
        result = 1;
        v13 = *(_QWORD *)FaultStatus & -v8;
        result_4 = 0;
        v30 = 0i64;
        v29 = 20;
        v31 = 0i64;
        MiInsertTbFlushEntry((INT64)&result, v13, 1i64, v7);
        MiFlushTbList((__int64)&result);
      }
    }
    v14 = v12;
    if( (*(_BYTE *)(FaultStatus + 8) & 0x10) == 0 )
    {
LABEL_24:
      v16 = *(_QWORD *)(FaultStatus + 16);
      if( (v16 & 1) != 0 )
      {
        v17 = (_BYTE *)(v16 & 0xFFFFFFFFFFFFFFFEui64);
        if( *v17 == 5 )
        {
          if( (unsigned int)MiValidVirtualizationFault(
                               (unsigned __int64 *)FaultStatus,
                               (__int64)v17,
                               (__int64)VirtualAddress) )
          {
            v18 = *(_QWORD *)FaultStatus;
            VirtualFaultPageInfo = (_QWORD *)MiGetVirtualFaultPageInfo((INT64)v17, *(_QWORD *)FaultStatus);
            MiPteInShadowRange((UINT64)v26);
            v20 = (v14 >> 12) & 0xFFFFFFFFFi64;
            v21 = v18 >> 12;
            for( i = 1i64; v7; --v7 )
            {
              v23 = v21;
              v21 >>= 9;
              v24 = i * (v23 & 0x1FF);
              i <<= 9;
              v20 += v24;
            }
            *VirtualFaultPageInfo ^= (v20 ^ *VirtualFaultPageInfo) & 0xFFFFFFFFFFFFFi64;
          }
        }
      }
      return 0;
    }
    if( v12 >= 0 )
    {
      if( (*(_DWORD *)(FaultStatus + 80) & 0x40) == 0 )
        MiCheckSystemNxFault(FaultStatus, v12, 7ui64);
      goto LABEL_24;
    }
    if( MiCanGrantExecute(*((_QWORD *)KeGetCurrentThread() + 23), *(_QWORD *)FaultStatus) )
    {
      MiPteInShadowRange((UINT64)v26);
      if( ((*((_QWORD *)MmGetPfnDb() + 6 * (((unsigned __int64)v12 >> 12) & 0xFFFFFFFFFi64) + 5) >> 50) & 1) != 0 )
      {
        v14 = v26[0] & 0x7FFFFFFFFFFFFFFFi64;
        v15 = v26[0] & 0x7FFFFFFFFFFFFFFFi64;
        v26[0] &= ~0x8000000000000000ui64;
        if( (MiFlags & 0x100) != 0 || (MiFlags & 0x200) != 0 )
        {
          v14 |= 0x20ui64;
          v15 = v14;
          v26[0] = v14;
        }
        MiWriteValidPteNewProtection((INT64 *)VirtualAddress, v15);
        if( (MiFlags & 0x100) == 0 && (MiFlags & 0x200) == 0 )
          KeFlushSingleTb(*(_QWORD *)FaultStatus, 1i64, 0i64);
        goto LABEL_24;
      }
    }
  }
  return -1073741819;
}

Referenced by: