MiDeleteLargeUserPde

NTSTATUS __stdcall MiDeleteLargeUserPde(INT64 a1, UINT64 a2, UINT64 a3){
  __int64 v3; 
  INT64 v4; 
  unsigned int v5; 
  int v7; 
  INT64 v8; 
  unsigned __int64 v9; 
  INT64 v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  UINT64 v13; 
  int v14; 
  _UNICODE_STRING *v15; 
  UINT8 v16; 
  wchar_t *v17; 
  UINT64 i; 
  unsigned __int64 Long; 
  int v20; 
  VOID *v21; 
  _MMPFN *PfnDb; 
  _MMPFN *v23; 
  _MI_TB_FLUSH_LIST *v24; 
  __int64 v25; 
  __int64 v26; 
  char v27; 
  INT64 v29; 
  __int64 v30; 
  UINT64 SpinCount; 
  int v33; 

  v3 = *(_QWORD *)(a1 + 168);
  v4 = a1;
  v30 = v3;
  v5 = a3;
  v7 = *(_DWORD *)(v3 + 104);
  v33 = v7;
  LODWORD(v8) = MI_READ_PTE_LOCK_FREE(a2);
  v29 = v8;
  v9 = v8;
  v10 = v8 & 1;
  if( (v8 & 1) != 0 )
  {
    LODWORD(v11) = MI_READ_PTE_LOCK_FREE((INT64)&v29);
    v9 = v11;
  }
  else if( *(&stru_140C4DB30 + 42) )
  {
    if( (v8 & 0x10) != 0 )
      v9 = v8 & 0xFFFFFFFFFFFFFFEFui64;
    else
      v9 = ~*(&stru_140C4DB30 + 42) & v8;
  }
  v12 = (v9 >> 12) & 0xFFFFFFFFFi64;
  v13 = (-(__int64)(v5 != 0) & 0xFFFFFFFFFFFFFFF1ui64) + 16;
  v14 = v7 & 0x10;
  if( v14 )
  {
    MiDeleteVadAwePtes(*(_QWORD *)(*(_QWORD *)(v3 + 16) + 32i64), a2, (INT64 *)(v3 + 112));
    goto LABEL_22;
  }
  if( !v5 )
  {
    for( i = 0i64; i < v13; ++i )
      *(_MMPTE *)(a2 + 8 * i) = ZeroPte;
LABEL_21:
    LODWORD(v21) = MiGetUsedPtesHandle((PSLIST_ENTRY)((__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16));
    MiDecreaseUsedPtesCount(v21, (unsigned int)v13);
    goto LABEL_22;
  }
  if( v10 )
  {
    MiRewritePteWithLockBit(*(_QWORD *)(v4 + 24), (INT64 *)a2, ZeroPte.u.Hard._bf_0);
  }
  else
  {
    Long = ZeroPte.u.Long;
    LOBYTE(v20) = MiPteInShadowRange(a2);
    if( v20 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
      Long = ZeroPte.u.Long | 0x8000000000000000ui64;
    *(_QWORD *)a2 = Long;
    v4 = a1;
  }
  if( v5 != 3 )
    goto LABEL_21;
LABEL_22:
  PfnDb = MmGetPfnDb();
  v23 = &PfnDb[v12];
  if( v10 )
  {
    v24 = *(_MI_TB_FLUSH_LIST **)(v4 + 16);
    if( v5 )
      MiInsertLargeTbFlushEntry(v24, v5, a2);
    else
      MiInsertTbFlushEntry(v24, (VOID *)((__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16), v13, 0i64);
  }
  if( !v14 )
  {
    LOBYTE(PfnDb) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v23, v15, v16, v17);
    if( !(_DWORD)PfnDb )
    {
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v23->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( v23->u2._bf_0 < 0 );
      }
      v25 = v30;
      *((_BYTE *)&v23->u3 + 2) = *(_BYTE *)(&v23->u3 + 1) & 0xF8 | 5;
      MiSetLeafPfnBuddy(v23, *(_QWORD *)(*(_QWORD *)(v25 + 16) + 40i64));
      LODWORD(PfnDb) = -1;
      *(_QWORD *)(*(_QWORD *)(v26 + 16) + 40i64) = v23;
      *((_BYTE *)&v23->u3 + 2) ^= (*((_BYTE *)&v23->u3 + 2) ^ v27) & 7;
      _InterlockedAnd64(&v23->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    }
  }
  if( (v33 & 0x800) != 0 && !v5 )
    *(_BYTE *)(v4 + 3) = 15;
  return(int)PfnDb;
}

Referenced by: