MiCountSharedPages

NTSTATUS __stdcall MiCountSharedPages(_MMVAD *Vad, _MMPTE *PointerPte, _MMPTE *LastPte){
  __int64 v6; 
  unsigned __int8 v7; 
  _MMPTE *v8; 
  __int64 v9; 
  __int64 v10; 
  unsigned __int64 v11; 
  unsigned __int64 v12; 
  VOID *v13; 
  _MMSUPPORT_FULL *AnyMultiplexedVm; 
  NTSTATUS v15; 
  UINT8 v16; 
  wchar_t *v17; 
  _MMPTE *PteBase; 
  _MMPTE *v19; 
  _MMPTE *v20; 
  UINT64 v21; 
  unsigned int v22; 
  _MMPTE *Pml4eBase; 
  __int64 v24; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v25; 
  _UNICODE_STRING *PxeUserLimit; 
  _UNICODE_STRING *v27; 
  int v28; 
  __int64 v29; 
  int v30; 
  __int64 v31; 
  unsigned __int8 v33; 
  INT64 p_Vm; 
  UINT64 v35; 
  __int64 v36; 
  __int128 v37; 
  __int64 v38; 
  _QWORD v39[22]; 

  v6 = 0i64;
  p_Vm = (INT64)&KeGetCurrentThread()->ApcState.Process->Vm;
  MiLockWorkingSetShared();
  v33 = v7;
  if( PointerPte > LastPte )
    goto LABEL_55;
  v8 = PointerPte;
  v9 = (_QWORD)MmGetPteBase() << 25;
  v36 = v9;
  v10 = (((_QWORD)LastPte << 25) - v9) >> 16;
  v38 = v10;
LABEL_3:
  v37 = 0i64;
  memset((char *)v39 + 2, 0i64, 0xAEu);
  LOWORD(v39[0]) = 2145;
  v11 = (((_QWORD)v8 << 25) - v9) >> 16;
  LODWORD(v12) = MiGetLeafVa(v11);
  if( v12 < 0xFFFF800000000000ui64 || v12 >= *(&stru_140C4DB30 + 937) && v12 <= *(&stru_140C4DB30 + 175) )
    AnyMultiplexedVm = &KeGetCurrentThread()->ApcState.Process->Vm;
  else
    AnyMultiplexedVm = (_MMSUPPORT_FULL *)MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v13);
  v15 = MiFastLockLeafPageTable((INT64)AnyMultiplexedVm, v11);
  if( v15 )
  {
    LODWORD(v37) = v15 - 1;
    PteBase = MmGetPteBase();
    v19 = (_MMPTE *)((char *)PteBase + ((v11 >> 9) & 0x7FFFFFFFF8i64));
    *((_QWORD *)&v37 + 1) = v19;
  }
  else
  {
    LOWORD(v39[0]) |= 4u;
    v39[21] = &v37;
    v39[2] = 0i64;
    v39[3] = AnyMultiplexedVm;
    BYTE2(v39[0]) = BYTE2(v39[0]) & 0xE3 | 4;
    v39[20] = MiGetNextPageTableTail;
    BYTE6(v39[0]) = v33;
    v39[4] = v11;
    v39[5] = v10;
    MiWalkPageTables((INT64)v39);
    v19 = (_MMPTE *)*((_QWORD *)&v37 + 1);
    PteBase = MmGetPteBase();
  }
  if( v19 )
  {
    v21 = (UINT64)PteBase + (((unsigned __int64)v19 >> 9) & 0x7FFFFFFFF8i64);
    v20 = LastPte + 1;
  }
  else
  {
    v20 = LastPte + 1;
    v21 = 0i64;
    v19 = LastPte + 1;
  }
  v22 = Vad->Core.u.LongFlags >> 7;
  v35 = v21;
  if( (Vad->Core.u.LongFlags & 0x70) != 32 || (v22 & 0x1F) == 1 )
  {
    if( (v22 & 5) != 5 )
      v6 += v19 - PointerPte;
    PointerPte = v19;
  }
  else
  {
    for( ; PointerPte < v19; ++PointerPte )
    {
      if( MiPteNeedsCommitCharge(Vad, PointerPte) == 1 )
        ++v6;
    }
  }
  if( PointerPte != v20 )
  {
    Pml4eBase = MmGetPml4eBase();
    v24 = (((_QWORD)PointerPte << 25) - v36) >> 16;
    while( 1 )
    {
      v25.Long = (unsigned __int64)PointerPte->u;
      PxeUserLimit = (_UNICODE_STRING *)MmGetPxeUserLimit();
      if( PointerPte >= Pml4eBase && PointerPte <= (_MMPTE *)PxeUserLimit )
        PxeUserLimit = (_UNICODE_STRING *)MmGetPxeUserLimit();
      if( v25.Long )
      {
        if( (v25.Long & 1) != 0 )
        {
          if( (v25.Long & 0x200) != 0 )
            goto LABEL_48;
          v27 = (_UNICODE_STRING *)&MmGetPfnDb()[(v25.Long >> 12) & 0xFFFFFFFFFi64];
          LOBYTE(v28) = MI_PFN_IS_PROTO(v27, PxeUserLimit, v16, v17);
          if( !v28 )
            goto LABEL_48;
          MiGetProtoPteAddress();
          if( ((unsigned __int64)v27->Buffer | 0x8000000000000000ui64) != v29 )
            goto LABEL_48;
        }
        else
        {
          if( (v25.Long & 0x400) == 0 )
            goto LABEL_48;
          LOBYTE(v30) = MiIsPrototypePteVadLookup(v25.Long);
          if( v30 )
          {
            if( (v25.Long & 0xA0) == 0xA0 )
              goto LABEL_48;
          }
          else
          {
            if( *(&stru_140C4DB30 + 42) && (v25.Long & 0x10) == 0 )
              v25.Long &= ~*(&stru_140C4DB30 + 42);
            MiGetProtoPteAddress();
            if( v25.Hard._bf_0 >> 16 != v31
              || (Vad->Core.u.LongFlags & 0x70) == 32 && MiPteNeedsCommitCharge(Vad, PointerPte) != 1 )
            {
              goto LABEL_48;
            }
          }
        }
      }
      else if( MiPteNeedsCommitCharge(Vad, PointerPte) != 1 )
      {
        goto LABEL_48;
      }
      ++v6;
LABEL_48:
      ++PointerPte;
      v24 += 4096i64;
      v8 = PointerPte;
      if( ((unsigned __int16)PointerPte & 0xFFF) == 0 || PointerPte > LastPte )
      {
        MiUnlockPageTableInternal(p_Vm, v35);
        v9 = v36;
        v10 = v38;
        if( PointerPte > LastPte )
          goto LABEL_54;
        goto LABEL_3;
      }
    }
  }
  if( v21 )
    MiUnlockPageTableInternal(p_Vm, v21);
LABEL_54:
  v7 = v33;
LABEL_55:
  MiUnlockWorkingSetShared((_MMSUPPORT_INSTANCE *)p_Vm, v7);
  return v6;
}

Referenced by: