MiDeletePerSessionProtos

NTSTATUS __stdcall MiDeletePerSessionProtos(_MI_PER_SESSION_PROTOS *Protos){
  _SUBSECTION *Subsection; 
  ULONG_PTR v2; 
  UINT8 v3; 
  unsigned __int64 SubsectionBase; 
  _CONTROL_AREA *ControlArea; 
  _MMPTE *v7; 
  UINT64 PtesInSubsection; 
  __int64 v9; 
  char *v10; 
  _MI_PARTITION *v11; 
  _MMPFN *v12; 
  _MMPFN *v13; 
  __int64 v14; 
  __int64 v16; 
  _MMPTE v17; 
  _STRING FullName; 
  UINT8 PageIrql; 
  unsigned __int64 v20; 

  Subsection = Protos->Subsection;
  v2 = 0;
  v3 = 17;
  SubsectionBase = (unsigned __int64)Protos->SubsectionBase;
  FullName.Buffer = 0i64;
  ControlArea = Subsection->ControlArea;
  v7 = Subsection->SubsectionBase;
  PtesInSubsection = Subsection->PtesInSubsection;
  PageIrql = 17;
  v9 = ControlArea->u1.Flags._bf_0 & 0x3FF;
  v10 = (char *)Protos->SessionProtoNode.Children[0] + 4096 * (((__int64)v7 - *(_QWORD *)ControlArea[1].gap8) >> 3);
  *(_QWORD *)&FullName.Length = v10;
  v11 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * v9);
  v20 = SubsectionBase + 8 * PtesInSubsection;
  if( SubsectionBase < v20 )
  {
    do
    {
      if( (SubsectionBase & 0xFFF) == 0 || v3 == 17 )
      {
        if( v3 != 17 )
          MiUnlockProtoPoolPage(v2, v3);
        while( 1 )
        {
          v12 = MiLockProtoPoolPage((_MMPTE *)SubsectionBase, &PageIrql);
          v2 = (unsigned int)v12;
          if( v12 )
            break;
          MmAccessFault(2ui64, (PVOID)SubsectionBase, 0, 0i64);
        }
        v3 = PageIrql;
      }
      v13 = MiLockLeafPage((_MMPTE *)SubsectionBase, 0i64);
      LODWORD(v14) = MI_READ_PTE_LOCK_FREE(SubsectionBase);
      if( v13 )
      {
        if( (MiFlags & 0x10000) != 0 && (MiFlags & 0x8000) != 0 && (((unsigned __int64)v13->u4._bf_0 >> 60) & 7) == 3 )
        {
          MiRemoveLockedPageChargeAndDecRef(v13);
          KeSetPagePrivilege((_PREFIX_TABLE *)(v13 - MmGetPfnDb()), &FullName, 16);
          MiClearPfnImageVerified(v13, 4ui64);
          v10 = *(char **)&FullName.Length;
        }
        if( MiDeleteTransitionPte((_MMPTE *)SubsectionBase, v13, 0x11u, 1ui64) == PageStillReferenced )
          --PtesInSubsection;
      }
      else
      {
        if( !v14 )
          break;
        if( (v14 & 0x400) == 0 )
        {
          v16 = MiSwizzleInvalidPte(768i64);
          if( v17.u.Long != v16 )
            MiReleasePageFileSpace(v11, v17, 1ui64);
        }
      }
      v10 += 4096;
      SubsectionBase += 8i64;
      *(_QWORD *)&FullName.Length = v10;
    }
    while( SubsectionBase < v20 );
    if( v3 != 17 )
      MiUnlockProtoPoolPage(v2, v3);
  }
  MiReturnCommit(v11, PtesInSubsection);
  MiUpdateSystemProtoPtesTree(&Protos->ProtosNode.Node, 0i64);
  ExFreePoolWithTag(Protos->SubsectionBase, 0);
  ExFreePoolWithTag(Protos, 0);
  return PtesInSubsection;
}

Referenced by: