MiDeletePteRun
VOID __stdcall MiDeletePteRun(
_MMPTE *PointerPte,
_MMPTE *LastPte,
_EPROCESS *CurrentProcess,
_MMPFN *DecayPfn,
_MI_DELETE_VA_INFO *DeleteInfo){
_QWORD *Long;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v6;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v7;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v9;
int v10;
unsigned __int64 PteBase;
unsigned __int64 v12;
unsigned __int64 v13;
int v14;
_MMPTE *v15;
unsigned __int64 v16;
_MMPFN *v17;
_MMPTE *v18;
_MMPTE *Pml4eBase;
__int64 v20;
_MMPTE *PxeUserLimit;
int v22;
unsigned int v23;
char *v24;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v25;
unsigned __int64 v26;
__int64 v27;
int v28;
__int64 v29;
_MMPFN *v30;
int v31;
int v32;
VOID *v33;
int v34;
__int64 v35;
_EPROCESS *v36;
VOID *v37;
__int64 v38;
__int64 v39;
_MMPTE *v40;
__int64 v41;
wchar_t *v42;
unsigned __int64 v43;
_MMPFN *v44;
__int64 v45;
unsigned __int8 v46;
_MMPTE *v47;
char v48;
unsigned __int64 v49;
__int64 v50;
__int64 v51;
_QWORD *v52;
unsigned __int64 v53;
int v54;
__int64 v55;
__int64 v56;
signed __int8 v57;
_UNICODE_STRING *v58;
char v59;
_MMPTE v60;
int v61;
__int64 v62;
int v63;
__int64 v64;
int v65;
unsigned __int64 v66;
__int64 v67;
wchar_t *v68;
unsigned int v69;
unsigned __int64 v70;
unsigned __int64 v71;
unsigned __int64 v72;
int v73;
int v74;
__int64 v75;
struct _KPRCB *CurrentPrcb;
__int64 v77;
_MI_ZERO_THREAD_CONTEXT *MmInternal;
unsigned __int64 v79;
unsigned __int64 v80;
char *v81;
_MMPTE *v82;
_MMPTE *v83;
__int64 v84;
__int64 v85;
_MMPTE *v86;
__int64 v87;
_UNICODE_STRING *v88;
char v89;
char v90;
int v91;
char v92;
_MI_PARTITION *v93;
INT64 v94;
__int64 v95;
_MI_PARTITION *v96;
_MI_PAGE_DELETE_RESULT v97;
__int64 v98;
__int64 v99;
char v100;
UINT64 v101;
_MMPFN *v102;
__int64 v103;
int v104;
unsigned __int64 v105;
__int64 v106;
_MI_PAGE_DELETE_RESULT v107;
int v108;
void *v109;
int v110;
int v111;
unsigned __int64 v112;
int v113;
unsigned __int64 v114;
PVOID BugCheckParameter4;
UINT64 v116;
unsigned int v117;
_QWORD *v119;
char v120;
_MMPTE *CurrentProcessa;
unsigned __int64 v122;
int v123;
__int16 v124;
PVOID BugCheckParameter3;
VOID *v126;
int v127;
ULONG_PTR CloneDescriptor[2];
__int64 v129;
int v130;
int v131;
_MI_PARTITION *Partition;
UINT64 SpinCount;
UINT64 v134;
unsigned __int64 v135;
unsigned __int64 v136;
INT64 v137;
_MMPFN *v138;
_MI_PARTITION *v139;
_MMPFN *v140;
UINT8 v141[8];
ULONG_PTR CloneBlock[2];
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v143;
unsigned __int64 v144;
__int64 v145;
_MMPFN_IDENTITY PfnIdentity[4];
__int64 v147;
_MI_DELETE_BATCH DeleteBatch[4];
__int128 v149[8];
__int64 v150[2];
Long = (_QWORD *)LastPte[2].u.Long;
v6.Long = (unsigned __int64)LastPte->u;
v7.Long = (unsigned __int64)LastPte[1].u;
v147 = 0i64;
v120 = BYTE4(LastPte[13].u.Proto._bf_0);
v9.Long = (unsigned __int64)LastPte[11].u;
v10 = LastPte[13].u.Long;
*(union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} *)v141 = (union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;})v9.Long;
PteBase = (unsigned __int64)MmGetPteBase();
*(_OWORD *)PfnIdentity = 0i64;
v119 = Long;
*(_OWORD *)DeleteBatch = 0i64;
v143.Long = v6.Long;
memset(v149, 0, sizeof(v149));
v144 = v7.Long;
v124 = v10;
v12 = PteBase << 25;
v122 = PteBase << 25;
v13 = (__int64)((v6.Long << 25) - (PteBase << 25)) >> 16;
if( v13 < PteBase || (v14 = 1, v13 > (unsigned __int64)MmGetPteLimit()) )
v14 = 0;
v15 = PointerPte - 208;
v16 = 0i64;
if( (PointerPte[23].u.Long & 7) != 0 )
v15 = 0i64;
v123 = v14;
v17 = 0i64;
CurrentProcessa = v15;
v139 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * HIWORD(PointerPte[21].u.TimeStamp._bf_0));
v127 = 0;
v117 = 0;
Partition = 0i64;
v140 = 0i64;
if( v6.Long <= v7.Long )
{
v18 = PointerPte;
Pml4eBase = MmGetPml4eBase();
while( 1 )
{
v20 = *(_QWORD *)v6.Long;
PxeUserLimit = MmGetPxeUserLimit();
if( v6.Long >= (unsigned __int64)Pml4eBase && v6.Long <= (unsigned __int64)PxeUserLimit )
LOBYTE(v10) = v124;
if( v20 )
{
v22 = v10 & 0x80;
v131 = v22;
if( (v10 & 0x80) != 0
&& (v6.Long < (unsigned __int64)Pml4eBase || v6.Long > (unsigned __int64)MmGetPml4eLimit()) )
{
v16 = (unsigned int)(v16 + 1);
v117 = v16;
if( !v17 )
{
v135 = *(unsigned __int64 *)((char *)&MmGetPdeBase()->u.Long
+ ((((__int64)((v6.Long << 25) - v12) >> 16) & 0xFFFFFFE00000ui64) >> 18));
v12 = (v135 >> 12) & 0xFFFFFFFFFi64;
v140 = &MmGetPfnDb()[v12];
}
}
v23 = v16;
if( (v20 & 0x400) != 0 )
{
LODWORD(v24) = 0;
v126 = 0i64;
*(_QWORD *)CloneDescriptor = 0i64;
BugCheckParameter3 = (PVOID)(v20 & 0xFFFFFFFFFFFFFBFEui64 | 1);
v25.Long = 0i64;
*(_QWORD *)CloneBlock = 0i64;
v26 = ((unsigned __int64)BugCheckParameter3 >> 12) & 0xFFFFFFFFFi64;
v27 = 48 * v26;
v145 = 48 * v26;
if( (MmGetPfnDb()[v26].u4._bf_0 & 0x4000000000000i64) == 0 )
goto LABEL_196;
v24 = (char *)MmGetPfnDb() + v27;
if( (v124 & 0x60) != 0 && !v14 )
{
MiDeleteBatch(DeleteBatch);
LOBYTE(v28) = MiIsPfnLocked((INT64)v24);
if( !v28 )
MiShowBadMapper(v26, 4ui64);
if( (v124 & 0x40) != 0 )
MiDoubleUnlockMdlPage((_MMPFN *)v24);
LODWORD(v29) = MiGetContainingPageTable(v6.Long);
v30 = &MmGetPfnDb()[v29];
v31 = 4;
LODWORD(v24) = 0;
v32 = 0;
goto LABEL_174;
}
if( !v24 )
{
LABEL_196:
MiDeleteBatch(DeleteBatch);
MiDereferenceIoPages(1i64, v26, 1i64);
LODWORD(v103) = MiGetContainingPageTable(v6.Long);
v30 = &MmGetPfnDb()[v103];
v31 = 4;
v32 = (int)v24;
goto LABEL_174;
}
if( (PointerPte[23].u.Long & 7) == 0
&& !v14
&& (((unsigned __int64)BugCheckParameter3 >> 12) & 0xF) == 0
&& ((__int64)(v144 - v6.Long) >> 3) + 1 >= 16
&& MiDeleteClusterPage(v6.Long, DeleteBatch, (_MI_DELETE_VA_INFO *)v12) == 1 )
{
v18 = PointerPte;
v16 = v23 + 15;
v6.Long += 120i64;
if( !v22 )
v16 = v23;
Pml4eBase = MmGetPml4eBase();
v117 = v16;
LABEL_240:
Long = v119;
LABEL_241:
v12 = v122;
goto LABEL_242;
}
v33 = (VOID *)(*((_QWORD *)v24 + 1) | 0x8000000000000000ui64);
LOBYTE(v34) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v24, *((_UNICODE_STRING **)v24 + 1), v12, (PWCHAR)v16);
if( v34 )
{
if( (*((_QWORD *)v24 + 5) & 0x1000000000i64) != 0 || v35 <= 0 )
{
v40 = MmGetPteBase();
if( v6.Long <= (unsigned __int64)&v40[0x7FFFFFFEFi64]
&& v6.Long >= (unsigned __int64)v40
&& v36->CloneRoot.Root )
{
*(_QWORD *)CloneBlock = v33;
*(_QWORD *)CloneDescriptor = MiLocateCloneAddress(v36, v33);
v39 = *(_QWORD *)CloneDescriptor;
if( *(_QWORD *)CloneDescriptor )
{
LODWORD(v41) = MiDeleteBatch(DeleteBatch);
v119[1] += v41;
}
}
else
{
v39 = 0i64;
}
v37 = 0i64;
}
else
{
v126 = v33;
v37 = v33;
LODWORD(v38) = MiDeleteBatch(DeleteBatch);
v39 = 0i64;
v119[1] += v38;
}
v42 = (wchar_t *)MmGetPml4eBase();
v136 = *(unsigned __int64 *)((char *)&MmGetPteBase()->u.Long + ((v6.Long >> 9) & 0x7FFFFFFFF8i64));
v43 = (v136 >> 12) & 0xFFFFFFFFFi64;
v44 = &MmGetPfnDb()[v43];
v138 = v44;
if( !LOBYTE(DeleteBatch[0]) )
goto LABEL_52;
if( v44 != *(_MMPFN **)&DeleteBatch[2]
|| *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * ((*((_QWORD *)v24 + 5) >> 39) & 0x3FFi64)) != v139
|| _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64) )
{
LODWORD(v45) = MiDeleteBatch(DeleteBatch);
v119[1] += v45;
}
v46 = DeleteBatch[0];
if( !LOBYTE(DeleteBatch[0]) )
{
LABEL_52:
*(_QWORD *)&DeleteBatch[2] = v44;
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( *((__int64 *)v24 + 3) < 0 );
}
v46 = DeleteBatch[0];
}
v47 = PointerPte;
if( (PointerPte[23].u.Long & 7) == 0 )
{
v48 = v24[34];
if( (v48 & 7) == 6
&& (*((_DWORD *)v24 + 4) & 0x400i64) == 0
&& (((unsigned __int8)BugCheckParameter3 & 0x42) != 0 || (v48 & 0x10) != 0)
&& !v37
&& !v39 )
{
*((_QWORD *)v149 + v46) = BugCheckParameter3;
if( !LOBYTE(DeleteBatch[0]) )
Partition = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267)
+ 8 * ((*((_QWORD *)v24 + 5) >> 39) & 0x3FFi64));
v49 = ZeroPte.u.Long;
Pml4eBase = MmGetPml4eBase();
if( v6.Long >= (unsigned __int64)Pml4eBase
&& v6.Long <= (unsigned __int64)MmGetPxeUserLimit()
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
&& (ZeroPte.u.Long & 1) != 0 )
{
v49 = ZeroPte.u.Long | 0x8000000000000000ui64;
}
*(_QWORD *)v6.Long = v49;
if( ++LOBYTE(DeleteBatch[0]) == 16 )
{
LODWORD(v50) = MiDeleteBatch(DeleteBatch);
Long = v119;
v18 = PointerPte;
v16 = v117;
v119[1] += v50;
goto LABEL_241;
}
v18 = PointerPte;
LABEL_239:
v16 = v117;
goto LABEL_240;
}
}
if( v46 )
{
BYTE1(DeleteBatch[0]) = 1;
LODWORD(v51) = MiDeleteBatch(DeleteBatch);
v52 = v119;
BYTE1(DeleteBatch[0]) = 0;
v119[1] += v51;
}
else
{
v52 = v119;
}
}
else
{
if( v24 == (char *)*(&stru_140C4DB30 + 494) )
{
v53 = ZeroPte.u.Long;
LOBYTE(v54) = MiPteInShadowRange(v6.Long);
if( v54 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v53 = ZeroPte.u.Long | 0x8000000000000000ui64;
v18 = PointerPte;
*(_QWORD *)v6.Long = v53;
Pml4eBase = MmGetPml4eBase();
goto LABEL_239;
}
LODWORD(v55) = MiDeleteBatch(DeleteBatch);
v52 = v119;
v119[1] += v55;
if( v33 != (VOID *)v6.Long )
KeBugCheckEx(0x1Au, (PVOID)0x403, (PVOID)v6.Long, BugCheckParameter3, *((PVOID *)v24 + 1));
v56 = *((_QWORD *)v24 + 5) & 0xFFFFFFFFFi64;
++v119[3];
HIDWORD(SpinCount) = 0;
v57 = _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64);
v138 = &MmGetPfnDb()[v56];
if( v57 )
{
do
{
do
KeYieldProcessorEx((UINT64 *)((char *)&SpinCount + 4));
while( *((__int64 *)v24 + 3) < 0 );
}
while( _interlockedbittestandset64((volatile signed __int32 *)v24 + 6, 0x3Fui64) );
}
*((_QWORD *)v24 + 3) |= 0x4000000000000000ui64;
if( v120 && v123 )
{
*(_OWORD *)PfnIdentity = 0i64;
v147 = 0i64;
MiIdentifyPfn((_MMPFN *)v24, PfnIdentity);
v127 = 1;
}
v47 = PointerPte;
if( (PointerPte[23].u.Long & 7) != 0 && ((*((_QWORD *)v24 + 5) >> 60) & 7) == 2 )
*((_QWORD *)v24 + 5) &= 0x8FFFFFFFFFFFFFFFui64;
}
v58 = (_UNICODE_STRING *)(unsigned __int8)v24[34];
if( ((unsigned __int8)v58 & 7) != 6 )
MiBadShareCount();
Partition = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * ((*((_QWORD *)v24 + 5) >> 39) & 0x3FFi64));
if( ((unsigned __int8)BugCheckParameter3 & 0x42) != 0 && ((unsigned __int8)v58 & 0x10) == 0 )
{
v59 = (char)v58;
if( (*((_DWORD *)v24 + 4) & 0x400i64) == 0 && ((unsigned __int8)v58 & 8) == 0 )
{
v60.u.Long = MiCapturePageFileInfoInline((_MMPTE *)v24 + 2, 1ui64, 0i64).u.Long;
v59 = v24[34];
v25.Long = v60.u.Long;
}
LOBYTE(v43) = v59 | 0x10;
v24[34] = v43;
}
if( (v47[23].u.Long & 7) != 0 )
{
LOBYTE(v61) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v24, v58, v43, v42);
if( v61 )
{
v62 = *((_QWORD *)v24 + 2);
if( (v62 & 0x400) == 0 || ((unsigned __int16)BugCheckParameter3 & 0x200) != 0 )
goto LABEL_106;
if( *(&stru_140C4DB30 + 42) && (v62 & 0x10) == 0 )
v62 &= ~*(&stru_140C4DB30 + 42);
if( (*(_DWORD *)(*(_QWORD *)(v62 >> 16) + 56i64) & 0x820) == 2080 )
LABEL_106:
++v52[3];
}
}
v63 = v123;
v130 = 0;
v31 = 4;
v32 = 0;
if( v123 && v131 )
{
if( (*((_QWORD *)v24 + 3) & 0x3FFFFFFFFFFFFFFFui64) >= 0x10000 )
v32 = 1;
v130 = v32;
}
v64 = *((_QWORD *)v24 + 3) ^ (*((_QWORD *)v24 + 3) ^ (*((_QWORD *)v24 + 3) - 1i64)) & 0x3FFFFFFFFFFFFFFFi64;
*((_QWORD *)v24 + 3) = v64;
if( (v64 & 0x3FFFFFFFFFFFFFFFi64) != 0 )
{
if( v123 )
{
v31 = 2;
if( (v124 & 0x100) == 0 )
*(_QWORD *)v24 &= ~1ui64;
}
}
else
{
LOBYTE(v65) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v24, (_UNICODE_STRING *)v64, 0, v42);
if( v65 )
{
v70 = *((_QWORD *)v24 + 2);
v129 = v67;
v71 = *((_QWORD *)v24 + 1);
v72 = v70 >> 5;
v73 = v69;
v74 = *((unsigned __int8 *)&MmGetPfnDb()[*((_QWORD *)v24 + 5) & 0xFFFFFFFFFi64].u3 + 2) >> 6;
if( !v74 || v74 == 3 )
{
v73 = 12;
}
else if( v74 == 2 )
{
v73 = 28;
}
LODWORD(v75) = MiMakeValidPte(0i64, *((_QWORD *)v24 + 5) & 0xFFFFFFFFFi64, v73 | 0xA0000000);
CurrentPrcb = KeGetCurrentPrcb();
v77 = v75;
MmInternal = (_MI_ZERO_THREAD_CONTEXT *)CurrentPrcb->MmInternal;
if( !MmInternal
|| (MiGetUltraMapping(MmInternal + 3112, 3i64),
v80 = v79,
v81 = (char *)MmGetPteBase() + ((v79 >> 9) & 0x7FFFFFFFF8i64),
*((_QWORD *)MmInternal + 1543) = v81,
!v79) )
{
v80 = ((unsigned __int64)CurrentPrcb->HyperPte & 0xFFFFFFFFFFFFF000ui64)
+ (((__int64)CurrentPrcb->HyperPte & 0xFFF) << 12);
v81 = (char *)MmGetPteBase() + ((v80 >> 9) & 0x7FFFFFFFF8i64);
}
v82 = MmGetPml4eBase();
v83 = MmGetPxeUserLimit();
if( v81 >= (char *)v82
&& v81 <= (char *)v83
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
&& (v77 & 1) != 0 )
{
v77 |= 0x8000000000000000ui64;
}
*(_QWORD *)v81 = v77;
v84 = (v71 >> 3) & 0x1FF;
v85 = *(_QWORD *)(v80 + 8 * v84);
v86 = (_MMPTE *)(v80 + 8 * v84);
v129 = v85;
v87 = v85 & 0xFFFFFFFFF000i64 | (32 * (v72 & 0x1F | 0x40));
if( *(&stru_140C4DB30 + 42) )
{
if( (v87 & *(&stru_140C4DB30 + 42)) != 0 )
v87 |= 0x10ui64;
else
v87 |= *(&stru_140C4DB30 + 42);
}
v129 = v87;
if( v86 >= v82
&& v86 <= v83
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
&& (v87 & 1) != 0 )
{
v87 |= 0x8000000000000000ui64;
}
v86->u.Long = v87;
MiUnmapPageInHyperSpaceWorker(v86, 0x11u, 0x80000000ui64);
v66 = *((_QWORD *)v24 + 3);
v67 = 0i64;
v32 = v130;
v27 = v145;
v6.Long = v143.Long;
v63 = v123;
v69 = 4;
}
--*((_WORD *)v24 + 16);
v88 = (_UNICODE_STRING *)((v66 >> 62) & 1);
if( *((_WORD *)v24 + 16) )
{
v89 = v24[34];
if( (_DWORD)v88 )
{
v90 = v89 | 7;
}
else if( (v89 & 0x10) != 0 )
{
v90 = v89 & 0xF8 | 3;
}
else
{
v90 = v89 & 0xF8 | 2;
}
v24[34] = v90;
if( (*((_DWORD *)v24 + 4) & 0x400i64) == 0 && MiGetPagingFileOffset((_MMPTE *)v24 + 2) )
*(_BYTE *)(*(_QWORD *)(*(&stru_140C4DB30 + 267) + 8 * ((*((_QWORD *)v24 + 5) >> 39) & 0x3FFi64)) + 675i64) = 1;
v31 = 3;
if( v63 && v131 )
v32 = 1;
LOBYTE(v91) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v24, v88, v67, v68);
if( v91 && !v126 && !*(_QWORD *)CloneDescriptor )
v31 = 4;
}
else
{
if( (_DWORD)v88 )
{
v92 = v24[35];
if( (v92 & 0x10) != 0 )
v24[35] = v92 & 0xEF;
v93 = *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8 * ((*((_QWORD *)v24 + 5) >> 39) & 0x3FFi64));
v137 = *((_QWORD *)v24 + 2);
if( (v137 & 0x400) == 0 )
{
if( (v137 & 4) != 0 || (v137 & 2) != 0 )
LODWORD(v94) = MI_READ_PTE_LOCK_FREE((INT64)&v137);
else
v94 = v67;
v137 = v94;
if( v94 )
MiReleasePageFileInfo(v93, (_MMPTE)v94, 0i64);
}
MiInsertPageInFreeOrZeroedList(v27 / 48, 2ui64, v67, (UINT64)v68, (UINT64)BugCheckParameter4, v116);
}
else
{
v98 = *((_QWORD *)v24 + 2);
v99 = -9i64;
if( (v98 & 0x400) != 0 )
v99 = -2049i64;
*((_QWORD *)v24 + 2) = v98 & v99;
v100 = v24[34];
if( (v100 & 0x10) != 0 )
{
v101 = 136i64;
if( *(_QWORD *)v141 != 1i64 )
v101 = 8i64;
MiInsertPageInList((_MMPFN *)v24, v101, v67);
}
else
{
v102 = *(_MMPFN **)v141;
v24[34] = v100 & 0xF8 | 2;
if( (unsigned __int64)v102 <= 1 || (unsigned int)MiGetPfnPriority((_MMPFN *)v24) >= 5 )
MiInsertPageInList((_MMPFN *)v24, v69, (UINT8)v102);
else
MiInsertProtectedStandbyPage(v102, (_MMPFN *)v24, (UINT8)v102);
}
}
v31 = 4;
}
}
if( v32 == 1 )
MiChargeCommit(Partition, 1ui64, 4ui64);
_InterlockedAnd64((volatile signed __int64 *)v24 + 3, 0x7FFFFFFFFFFFFFFFui64);
LODWORD(v24) = 0;
if( v127 )
{
v150[1] = 24i64;
v150[0] = (__int64)PfnIdentity;
EtwTraceKernelEvent((__int64)v150, 1u, 0x20000001u, 0x277u, 0x11401B02u);
v127 = 0;
}
v30 = v138;
LABEL_174:
if( v30 )
{
LODWORD(v134) = (_DWORD)v24;
while( _interlockedbittestandset64((volatile signed __int32 *)&v30->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx(&v134);
while( v30->u2._bf_0 < 0 );
}
if( (*(_BYTE *)(&v30->u3 + 1) & 7) != 6 )
MiBadShareCount();
v95 = (v30->u2._bf_0 & 0x3FFFFFFFFFFFFFFFi64) - 1;
v30->u2._bf_0 ^= (v30->u2._bf_0 ^ v95) & 0x3FFFFFFFFFFFFFFFi64;
if( !v95 )
MiPfnShareCountIsZero(v30, 0i64);
_InterlockedAnd64(&v30->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
}
v96 = Partition;
if( v25.Long )
MiReleasePageFileInfo(Partition, (_MMPTE)v25.Long, 1ui64);
if( v126 )
{
v97 = MiDecrementCombinedPte(CurrentProcessa + 208);
goto LABEL_199;
}
if( *(_QWORD *)CloneDescriptor )
{
v97 = MiDecrementCloneBlockReference(CloneDescriptor[0], CloneBlock[0], (ULONG_PTR)CurrentProcessa);
LABEL_199:
v31 = v97;
}
if( v32 == 1 )
goto LABEL_207;
if( v31 == 3 )
{
if( (PointerPte[23].u.Long & 7) == 0 || v96 == v139 )
{
Long = v119;
++v119[1];
goto LABEL_208;
}
LABEL_207:
Long = v119;
goto LABEL_208;
}
Long = v119;
if( v31 == 5 )
++v119[2];
LABEL_208:
if( (PointerPte[23].u.Long & 7) != 0 )
{
LOBYTE(v104) = MiPteIsSessionDynamicBuffer(v6.Long);
if( !v104 )
++*Long;
}
if( v6.Long < (unsigned __int64)MmGetPml4eBase()
|| v6.Long > (unsigned __int64)MmGetPml4eLimit()
|| (PointerPte[23].u.Long & 7) == 0 )
{
v105 = ZeroPte.u.Long;
Pml4eBase = MmGetPml4eBase();
if( v6.Long >= (unsigned __int64)Pml4eBase
&& v6.Long <= (unsigned __int64)MmGetPxeUserLimit()
&& (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0
&& (ZeroPte.u.Long & 1) != 0 )
{
v105 = ZeroPte.u.Long | 0x8000000000000000ui64;
}
v18 = PointerPte;
v16 = v117;
*(_QWORD *)v6.Long = v105;
goto LABEL_241;
}
MiWriteTopLevelPxe(v6.Long, ZeroPte.u.Hard._bf_0);
v18 = PointerPte;
LABEL_215:
v16 = v117;
Pml4eBase = MmGetPml4eBase();
goto LABEL_241;
}
LODWORD(v106) = MiDeleteBatch(DeleteBatch);
Long[1] += v106;
v107 = MiTryDeleteTransitionPte((_MMPTE *)v6.Long);
if( v107 == PageChangedState )
{
LODWORD(v109) = MI_READ_PTE_LOCK_FREE(v6.Hard._bf_0);
BugCheckParameter3 = v109;
MiReleasePageFileSpace(v139, (_MMPTE)v109, 1ui64);
if( (v18[23].u.Long & 7) != 0 )
{
++Long[3];
LOBYTE(v111) = MiPteIsSessionDynamicBuffer(v6.Long);
if( !v111 )
++*Long;
}
else
{
IS_PTE_NOT_DEMAND_ZERO();
if( v110 )
++Long[3];
}
v112 = ZeroPte.u.Long;
LOBYTE(v113) = MiPteInShadowRange(v6.Long);
if( v113 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
v112 = ZeroPte.u.Long | 0x8000000000000000ui64;
*(_QWORD *)v6.Long = v112;
goto LABEL_215;
}
++Long[3];
if( (PointerPte[23].u.Long & 7) != 0 )
{
LOBYTE(v108) = MiPteIsSessionDynamicBuffer(v6.Long);
if( !v108 )
++*Long;
}
v18 = PointerPte;
v16 = v117;
v12 = v122;
Pml4eBase = MmGetPml4eBase();
if( v107 == PageStillReferenced )
++Long[1];
}
LABEL_242:
v17 = v140;
v6.Long += 8i64;
v143.Long = v6.Long;
if( v6.Long > v144 )
break;
v14 = v123;
LOBYTE(v10) = v124;
}
}
MiDeleteBatch(DeleteBatch);
if( v117 )
{
v114 = HIWORD(*((_DWORD *)&v17->3 + 4)) & 0x3FF;
if( v114 < v117 )
KeBugCheckEx(0x1Au, (PVOID)0x41790, v17, (PVOID)v114, (PVOID)v117);
HIDWORD(v134) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&v17->u2, 0x3Fui64) )
{
do
KeYieldProcessorEx((UINT64 *)((char *)&v134 + 4));
while( v17->u2._bf_0 < 0 );
}
v17->OriginalPte.u.Long ^= ((unsigned int)v17->OriginalPte.u.Long ^ (((unsigned int)(v17->OriginalPte.u.Long >> 16)
- v117) << 16)) & 0x3FF0000;
_InterlockedAnd64(&v17->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
}
}Referenced by:
MiDeleteEmptyPageTableTail
MiDeleteVaTail