MxCreatePfns

VOID __stdcall MxCreatePfns(
        _MMPTE *PointerPxe,
        _MMPTE *EndPxe,
        UINT64 PagingLevel,
        _LOADER_PARAMETER_BLOCK *LoaderBlock){
  _MMPTE *PteBase; 
  int v6; 
  unsigned __int64 v8; 
  UINT64 v9; 
  UINT64 v10; 
  UINT64 v11; 
  __int64 v12; 
  UINT64 v13; 
  UINT64 v14; 
  __int64 v15; 
  _MMPFN *v16; 
  unsigned __int64 v17; 
  unsigned __int16 v18; 
  __int64 v19; 
  __int64 v20; 
  UINT64 v21; 
  unsigned __int64 v22; 
  unsigned __int16 v23; 
  __int64 v24; 
  __int64 v25; 
  UINT64 v26; 
  unsigned __int64 v27; 
  unsigned __int64 v28; 
  UINT64 v29; 
  UINT64 v30; 
  int v31; 

  if( PointerPxe <= EndPxe )
  {
    v31 = PagingLevel;
    PteBase = MmGetPteBase();
    v6 = PagingLevel;
    v8 = (unsigned __int64)PointerPxe;
    while( 1 )
    {
      LODWORD(v9) = MI_READ_PTE_LOCK_FREE(v8);
      v29 = v9;
      v10 = v9;
      if( (v9 & 1) != 0 )
        break;
LABEL_13:
      v8 += 8i64;
      if( v8 > (unsigned __int64)EndPxe )
        return;
    }
    v11 = v9;
    MiPteInShadowRange((UINT64)&v29);
    v12 = (v11 >> 12) & 0xFFFFFFFFFi64;
    LODWORD(v13) = MI_READ_PTE_LOCK_FREE((INT64)PteBase + ((v8 >> 9) & 0x7FFFFFFFF8i64));
    v30 = v13;
    v14 = v13;
    MiPteInShadowRange((UINT64)&v30);
    v15 = (v14 >> 12) & 0xFFFFFFFFFi64;
    v16 = &MmGetPfnDb()[v15];
    v16->u2._bf_0 ^= (v16->u2._bf_0 ^ (v16->u2._bf_0 + 1)) & 0x3FFFFFFFFFFFFFFFi64;
    if( v6 )
    {
      if( (v10 & 0x80u) == 0i64 )
      {
        MxCreatePfn(v12, (_MMPTE *)v8, v10, v15);
        if( (_MMPTE *)v8 != MmGetPxeSelfRef() )
        {
          PteBase = MmGetPteBase();
          MxCreatePfns(
            (_MMPTE *)((__int64)((v8 << 25) - ((_QWORD)PteBase << 25)) >> 16),
            (_MMPTE *)(((__int64)((v8 << 25) - ((_QWORD)PteBase << 25)) >> 16) + 4088),
            (unsigned int)(v6 - 1),
            LoaderBlock);
          goto LABEL_13;
        }
        goto LABEL_12;
      }
      v22 = v10 & 0xFFFFFFFFFFFFFFFBui64;
      v23 = v22 | 0x800;
      if( (v22 & 0x42) == 0 )
        v23 = v22;
      v24 = v22 | 0x800;
      v25 = ((unsigned __int16)(*(&stru_140C4DB30 + 536) << 8) ^ v23) & 0x100;
      if( (v22 & 0x42) == 0 )
        v24 = v22;
      v26 = v24 ^ v25;
      MiWriteValidPteNewProtection((INT64 *)v8, v26);
      v27 = (__int64)((v8 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
      v28 = v27 + 4096;
      while( v27 < v28 )
      {
        if( MiIsRegularMemory(LoaderBlock, v12) )
          MxCreatePfn(v12, (_MMPTE *)v27, v26, v15);
        ++v12;
        v27 += 8i64;
      }
    }
    else
    {
      v17 = v10 & 0xFFFFFFFFFFFFFFFBui64;
      v18 = v17 | 0x800;
      if( (v17 & 0x42) == 0 )
        v18 = v17;
      v19 = v17 | 0x800;
      v20 = ((unsigned __int16)(*(&stru_140C4DB30 + 536) << 8) ^ v18) & 0x100;
      if( (v17 & 0x42) == 0 )
        v19 = v17;
      v21 = v19 ^ v20;
      MiWriteValidPteNewProtection((INT64 *)v8, v21);
      if( MiIsRegularMemory(LoaderBlock, v12) )
        MxCreatePfn(v12, (_MMPTE *)v8, v21, v15);
    }
    v6 = v31;
LABEL_12:
    PteBase = MmGetPteBase();
    goto LABEL_13;
  }
}

Referenced by: