MiDemoteCombinedPte

NTSTATUS __stdcall MiDemoteCombinedPte(_MMSUPPORT_INSTANCE *Vm, _MMPTE *PointerPte, _MMPTE *ProtoPte){
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v3; 
  bool v6; 
  _MMPTE *v7; 
  unsigned __int64 v8; 
  _MMPFN *v9; 
  __int64 v10; 
  __int64 v11; 
  _EPROCESS *Process; 
  char WsleContents; 
  __int64 v14; 
  unsigned __int64 v15; 
  UINT8 v16; 
  UINT64 v17; 
  unsigned __int16 ReferenceCount; 
  unsigned __int64 v19; 
  __int64 bf_0; 
  union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v22; 
  _MMPFN *PfnDb; 
  _MMPFN *v24; 
  int v25; 
  __int64 v26; 
  __int64 v27; 
  INT64 Long; 
  __int64 v29; 
  unsigned __int64 v30; 
  VOID *Va; 
  _MMSUPPORT_INSTANCE *Vma; 
  _MMPTE *ProtoPtea; 
  _MMPFN_IDENTITY PfnIdentity[4]; 
  __int64 v35; 
  __int64 v36[2]; 

  v3.Long = (unsigned __int64)PointerPte->u;
  ProtoPtea = ProtoPte;
  *(_OWORD *)PfnIdentity = 0i64;
  v35 = 0i64;
  Vma = Vm;
  v6 = ProtoPte[-2].u.Long <= 1;
  v7 = ProtoPte - 6;
  Long = v3.Long;
  if( !v6 )
    return 0;
  v26 = *(_QWORD *)(((unsigned __int64)v7 & 0xFFFFFFFFFFFFF000ui64) + 0x10);
  LODWORD(v8) = MI_READ_PTE_LOCK_FREE((INT64)&Long);
  v9 = &MmGetPfnDb()[(v8 >> 12) & 0xFFFFFFFFFi64];
  v10 = ((unsigned __int64)v9->u4._bf_0 >> 39) & 0x3FF;
  v11 = (__int64)(((_QWORD)PointerPte << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
  Va = (VOID *)v11;
  v29 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * v10);
  Process = 0i64;
  if( (Vm->Flags._bf_0 & 7) == 0 )
  {
    Process = KeGetCurrentThread()->ApcState.Process;
    if( Process->ForkInProgress )
      return 0;
  }
  WsleContents = MiGetWsleContents(v10, v11);
  LODWORD(v15) = MI_READ_PTE_LOCK_FREE(v14 + (((unsigned __int64)PointerPte >> 9) & 0x7FFFFFFFF8i64));
  v30 = v15 >> 12;
  v25 = *(&PerfGlobalGroupMask + 1) & 0x8000001;
  v16 = MiLockPageInline(v9);
  ReferenceCount = v9->u3.ReferenceCount;
  v19 = v16;
  if( (ReferenceCount == 1 || ReferenceCount == 2 && (*(_BYTE *)(&v9->u3 + 1) & 8) != 0)
    && *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * Vm->PartitionId) == v29
    && _InterlockedCompareExchange64((volatile signed __int64 *)&v7[4], 0i64, 1i64) == 1 )
  {
    _InterlockedExchangeAdd((volatile signed __int32 *)(v26 + 392), 0xFFFFFFFF);
    bf_0 = v9->u4._bf_0;
    v9->PteLong = (unsigned __int64)PointerPte;
    v27 = bf_0 & 0xFFFFFFFFFi64;
    v22.Long = (unsigned __int64)v9->OriginalPte.u;
    v9->u4._bf_0 = v30 & 0xFFFFFFFFFi64 | bf_0 & 0x7FFFFFF000000000i64;
    if( ((v22.Long >> 5) & 5) == 5 )
      v9->OriginalPte.u.Long = v22.Long ^ (LOWORD(v22.Long) ^ (unsigned __int16)(32 * ((v22.Long >> 5) & 0xFFFE))) & 0x3E0;
    if( v25 )
      MiIdentifyPfn(v9, PfnIdentity);
    _InterlockedAnd64(&v9->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(v19);
    if( (v3.Long & 0x200) != 0 )
    {
      Long = v3.Long & 0xFFFFFFFFFFFFF5DFui64 | 0x820;
      MiWriteValidPteNewProtection((INT64 *)PointerPte, Long);
    }
    PfnDb = MmGetPfnDb();
    v24 = &PfnDb[v27];
    if( (WsleContents & 0xF) == 8 )
      MiUnlockPageTableCharges((_DWORD)PfnDb + 48 * v27, 1u, v17);
    MiLockAndDecrementShareCount(v24, 0i64);
    MiUpdateWorkingSetPrivateSize(Vma, Va, 1i64);
    if( Process )
      _InterlockedExchangeAdd64((volatile signed __int64 *)&Process->NumberOfPrivatePages, 1ui64);
    if( v25 )
    {
      MiLogCombinedPteDelete(ProtoPtea);
      v36[1] = 24i64;
      v36[0] = (__int64)PfnIdentity;
      EtwTraceKernelEvent((__int64)v36, 1u, 0x28000001u, 0x276u, 0x11401B02u);
    }
    MiFreeCombineBlock((_MI_COMBINE_BLOCK *)v7);
    return 1;
  }
  else
  {
    _InterlockedAnd64(&v9->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    __writecr8(v16);
    return 0;
  }
}

Referenced by: