MiDeleteSystemPageTable

NTSTATUS __stdcall MiDeleteSystemPageTable(INT64 a1, UINT64 a2, INT64 a3){
  __int64 v3; 
  _MI_TB_FLUSH_LIST *v5; 
  int v6; 
  INT64 v8; 
  char v9; 
  int v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  _MMPTE *PteBase; 
  _MMPFN *v14; 
  CHAR v16; 
  VOID *v17; 
  __int64 v18; 
  int v19; 
  int v20; 
  unsigned __int64 Long; 
  unsigned __int64 v22; 
  _MMPTE *v23; 
  unsigned __int64 v24; 
  _KLOCK_QUEUE_HANDLE LockHandle; 
  INT64 v26; 

  v3 = *(_QWORD *)(a1 + 168);
  memset(&LockHandle, 0, sizeof(LockHandle));
  v5 = *(_MI_TB_FLUSH_LIST **)(v3 + 16);
  v6 = a3;
  LODWORD(v8) = MI_READ_PTE_LOCK_FREE(a2);
  v9 = v8;
  v26 = v8;
  if( (v8 & 1) != 0 )
  {
    v10 = 0;
    LODWORD(v11) = MI_READ_PTE_LOCK_FREE((INT64)&v26);
    v12 = (v11 >> 12) & 0xFFFFFFFFFi64;
    PteBase = MmGetPteBase();
    if( v9 >= 0 )
    {
      v14 = &MmGetPfnDb()[v12];
      if( v6 <= ((*(unsigned __int8 *)(a1 + 2) >> 2) & 7) )
      {
        v16 = 0;
      }
      else
      {
        if( (v14->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) != 1 )
          return 0;
        if( v14->u3.ReferenceCount != 1 )
          return 0;
        LODWORD(v18) = RtlCompareMemoryUlong(
                         (VOID *)((__int64)((a2 << 25) - ((_QWORD)PteBase << 25)) >> 16),
                         4096,
                         0i64);
        if( v18 != 4096 )
          return 0;
        v16 = 1;
      }
      if( v6 >= 1 )
      {
        if( !MiEvictPageTableLock(*(_QWORD *)(a1 + 24), (UINT64 *)a2, ZeroPte.u.Hard._bf_0, v16) )
          return 0;
        v10 = 1;
      }
      MiAddSystemPageTableToList((_QWORD *)(v3 + 8), (__int64)v14);
      PteBase = MmGetPteBase();
    }
    if( v6 >= 1 && v9 < 0 )
    {
      MiInsertLargeTbFlushEntry(v5, (unsigned int)v6, a2);
    }
    else
    {
      MiInsertTbFlushEntry(v5, (VOID *)((__int64)((a2 << 25) - ((_QWORD)PteBase << 25)) >> 16), 1ui64, 0i64);
      if( v6 == 1 )
      {
        LODWORD(v17) = MiGetLeafVa(a2);
        MiInsertTbFlushEntry(v5, v17, 0x200ui64, 0i64);
      }
    }
    if( !v10 )
    {
      LOBYTE(v19) = MiPteInShadowRange(a2);
      v20 = v19;
      if( v6 == 3 )
      {
        KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 522, &LockHandle);
        Long = ZeroPte.u.Long;
        if( v20 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
          Long = ZeroPte.u.Long | 0x8000000000000000ui64;
        *(_QWORD *)a2 = Long;
        KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
        __writecr8(LockHandle.OldIrql);
        goto LABEL_28;
      }
      v24 = ZeroPte.u.Long;
      if( v19 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
        v24 = ZeroPte.u.Long | 0x8000000000000000ui64;
      *(_QWORD *)a2 = v24;
    }
    if( v6 == 3 )
    {
LABEL_28:
      LODWORD(v22) = MiGetLeafVa(a2);
      v23 = (_MMPTE *)((char *)MmGetPteBase() + ((v22 >> 9) & 0x7FFFFFFFF8i64));
      MiReplicatePteChange(v23, v23);
    }
  }
  return 0;
}

Referenced by: