MiClearPfnImageVerified

VOID __stdcall MiClearPfnImageVerified(PVOID Pfn1, UINT64 VerifyType){
  char v3; 
  UINT8 v4; 
  NTSTATUS PagePrivilege; 
  _PREFIX_TABLE *v6; 
  int v7; 
  INT16 v8; 
  _STRING PrivilegedIdentity; 

  PrivilegedIdentity = 0i64;
  v3 = VerifyType;
  if( ((*((_QWORD *)Pfn1 + 5) >> 60) & 7) == 3 )
  {
    if( (VerifyType & 4) != 0 )
      v4 = 17;
    else
      v4 = MiLockPageInline((_MMPFN *)Pfn1);
    if( (v3 & 8) != 0 )
    {
      PagePrivilege = MiGetPagePrivilege((ULONG_PTR)Pfn1, 1ui64, (_KE_PRIVILEGED_PAGE_IDENTITY *)&PrivilegedIdentity);
      if( PagePrivilege )
      {
        v6 = (_PREFIX_TABLE *)(((_BYTE *)Pfn1 - (_BYTE *)MmGetPfnDb()) / 48);
        if( (PagePrivilege & 0x20) != 0 )
          LOWORD(v7) = 512;
        else
          v7 = (v3 & 0x10) != 0 ? 32 : 16;
        v8 = v7 | 0x80;
        if( (v3 & 0x40) == 0 )
          v8 = v7;
        if( (int)KeSetPagePrivilege(v6, &PrivilegedIdentity, v8) < 0 )
          KeBugCheckEx(0x1Au, (PVOID)0x5150B, v6, 0i64, 0i64);
      }
    }
    *((_QWORD *)Pfn1 + 5) &= 0x8FFFFFFFFFFFFFFFui64;
    if( v4 != 17 )
    {
      _InterlockedAnd64((volatile signed __int64 *)Pfn1 + 3, 0x7FFFFFFFFFFFFFFFui64);
      __writecr8(v4);
    }
  }
}

Referenced by: