MiInitializeTbFlushStamps
CHAR __stdcall MiInitializeTbFlushStamps(UINT64 *a1){
UINT64 v1;
_ETHREAD *CurrentThread;
UINT64 v4;
int v5;
int v7[10];
v1 = *a1;
MiPteInShadowRange((UINT64)a1);
_InterlockedOr(v7, 0);
if( v1 && *(&stru_140C4DB30 + 42) )
{
if( (v1 & 0x10) != 0 )
LODWORD(v1) = v1 & 0xFFFFFFEF;
else
LODWORD(v1) = ~*(&stru_140C4DB30 + 84) & v1;
}
CurrentThread = (_ETHREAD *)MiSwizzleInvalidPte(((unsigned __int64)(unsigned int)KiTbFlushTimeStamp << 32) | (unsigned int)v1);
v4 = (UINT64)CurrentThread;
if( v5 )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (CurrentThread->Tcb.ApcState.Process->Flags3 & 0x1000) != 0 && (v4 & 1) != 0 )
{
LOBYTE(CurrentThread) = 0;
v4 |= 0x8000000000000000ui64;
}
}
*a1 = v4;
return(char)CurrentThread;
}Referenced by:
MiDeleteNonPagedPoolPte
MiDeleteSystemPagableVm
MiReleasePtes
MiTerminateWsleCluster