MiSplitDirectMapPage

NTSTATUS __stdcall MiSplitDirectMapPage(_SUBSECTION *Subsection, _MI_COLOR_BASE *ColorBase, UINT64 PageFrameIndex){
  _MMPFN *PfnDb; 
  _MMPFN *v6; 
  signed __int32 v7; 
  unsigned int v8; 
  ULONG_PTR *v9; 
  UINT64 v10; 
  UINT64 v11; 
  UINT64 v12; 
  INT64 v13; 
  unsigned __int64 v14; 
  __int128 v15; 
  __m128i v16; 
  __int64 v17; 
  __int64 v18; 
  int v19; 
  __int64 v20; 
  __int16 v21; 
  _MMPFN *v22; 
  UINT64 v23; 
  _QWORD *v24; 
  INT64 v25; 
  __int64 v26; 
  __int64 v27; 
  int v28; 
  INT64 v30[2]; 
  UINT64 v31[2]; 
  __m128i v32; 
  _CONTROL_AREA *ControlArea; 

  PfnDb = MmGetPfnDb();
  v6 = &PfnDb[PageFrameIndex];
  v7 = ColorBase[2] & _InterlockedExchangeAdd(*(volatile signed __int32 **)ColorBase, 1u);
  ControlArea = Subsection->ControlArea;
  v8 = v7 | ColorBase[3];
  v9 = *(ULONG_PTR **)(*(&stru_140C4DB30 + 267) + 8i64 * (Subsection->ControlArea->u1.Flags._bf_0 & 0x3FF));
  for( LODWORD(v10) = MiGetPage(v9, v8, 0i64); ; LODWORD(v10) = MiGetPage(v9, v8, 0i64) )
  {
    v12 = v10;
    if( v10 != -1i64 )
      break;
    MiWaitForFreePage((_MI_PARTITION *)v9, v11);
  }
  v13 = (INT64)&PfnDb[v10];
  v14 = MiLockPageInline(v6);
  MiLockNestedPageAtDpcInline((_MMPFN *)v13);
  MiFinalizePageAttribute((_MMPFN *)v13, (_MI_PFN_CACHE_ATTRIBUTE)(*((unsigned __int8 *)&v6->u3 + 2) >> 6), 1ui64);
  v15 = *((_OWORD *)&v6->3 + 1);
  *(_LIST_ENTRY *)v30 = v6->ListEntry;
  v16 = *(__m128i *)&v6->u3.ReferenceCount;
  *(_OWORD *)v31 = v15;
  v32 = v16;
  v17 = ((unsigned __int16)Subsection->u.SubsectionFlags._bf_0 >> 1) & 0x1F;
  v32.m128i_i64[1] = _mm_srli_si128(v16, 8).m128i_u64[0] & 0xFFFDFFFFFFFFFFFFui64;
  v18 = MiSwizzleInvalidPte(32 * v17);
  LOBYTE(v19) = MiPteInShadowRange((UINT64)v31);
  if( v19 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v18 & 1) != 0 )
    v18 |= v20;
  v31[0] = v18;
  MiCopyPfnEntryEx(v13, (INT64)v30);
  *(_BYTE *)(v13 + 34) |= 0x10u;
  *(_WORD *)(v13 + 32) = v21;
  MiAddLockedPageCharge(v22, 1ui64);
  MiDereferenceControlAreaPfnList(ControlArea, 0i64, v23, 2ui64);
  MiCopyPage(v12, PageFrameIndex, 0i64, 6ui64);
  *((_BYTE *)&v6->u3 + 2) = *(_BYTE *)(&v6->u3 + 1) & 0xF8 | 5;
  v24 = (char *)MiMapPageInHyperSpaceWorker(v6->u4._bf_0 & 0xFFFFFFFFFi64, 0i64, 0x80000000ui64)
      + 8 * ((LODWORD(v6->PteLong) >> 3) & 0x1FF);
  LODWORD(v25) = MI_READ_PTE_LOCK_FREE((INT64)v24);
  LODWORD(v26) = MiUpdateTransitionPteFrame(v25, v12);
  v27 = v26;
  LOBYTE(v28) = MiPteInShadowRange((UINT64)v24);
  if( v28 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v27 & 1) != 0 )
    v27 |= 0x8000000000000000ui64;
  *v24 = v27;
  MiUnmapPageInHyperSpaceWorker(v24, 0x11u, 0x80000000ui64);
  _InterlockedAnd64((volatile signed __int64 *)(v13 + 24), 0x7FFFFFFFFFFFFFFFui64);
  _InterlockedAnd64(&v6->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
  __writecr8(v14);
  return v12;
}

Referenced by: