MiLogPageAccess

VOID __stdcall MiLogPageAccess(_MMSUPPORT_INSTANCE *Vm, _MMPTE *PointerPte){
  unsigned __int64 *AgeDistribution; 
  wchar_t *bf_0; 
  unsigned __int64 v4; 
  unsigned int v6; 
  __int64 v7; 
  _MMPFN *v8; 
  unsigned __int64 *v9; 
  _UNICODE_STRING *v10; 
  _MM_PAGE_ACCESS_INFO_HEADER *AccessLog; 
  int v12; 
  __int64 v13; 
  unsigned __int64 FirstFileEntry; 
  __int64 v15; 
  unsigned __int64 v16; 
  bool v17; 
  __int64 v18; 
  bool v19; 
  __int64 v20; 
  signed __int64 *v21; 
  UINT64 v22; 
  volatile int *v23; 
  unsigned __int8 v24; 
  _EX_FAST_REF *v25; 
  unsigned __int64 v26; 
  signed __int64 v27; 
  signed __int64 v28; 
  __int64 v29; 
  unsigned int v30; 
  __int64 v31; 
  unsigned __int64 *FileEntry; 
  unsigned __int64 *v33; 
  unsigned __int64 v34; 
  _KSPIN_LOCK_QUEUE *volatile Next; 
  unsigned int v36; 
  _KLOCK_QUEUE_HANDLE LockQueue; 
  int v38; 
  int v39; 
  __int64 v40; 
  _MMPTE *PteAddress; 

  bf_0 = (wchar_t *)(unsigned __int8)Vm->Flags._bf_0;
  AgeDistribution = (unsigned __int64 *)((char *)&stru_140C4DB30 + 6584);
  v39 = 3;
  LOBYTE(bf_0) = (unsigned __int8)bf_0 & 7;
  *(_QWORD *)&LockQueue.OldIrql = 0i64;
  v38 = 0;
  v4 = (unsigned __int64)PointerPte;
  if( (_BYTE)bf_0 != 2 )
    AgeDistribution = Vm[1].AgeDistribution;
  v6 = (unsigned __int8)PointerPte & 1;
  v36 = v6;
  if( ((unsigned __int8)PointerPte & 1) != 0 )
    v4 = (unsigned __int64)PointerPte & 0xFFFFFFFFFFFFFFFEui64;
  v7 = (*(_QWORD *)v4 >> 12) & 0xFFFFFFFFFi64;
  v8 = &MmGetPfnDb()[v7];
  v9 = (unsigned __int64 *)((char *)&stru_140C4DB30 + 6608);
  if( (_BYTE)bf_0 != 2 )
    v9 = &Vm[1].AgeDistribution[3];
  LockQueue.LockQueue.Lock = v9;
  LockQueue.LockQueue.Next = 0i64;
  v10 = (_UNICODE_STRING *)_InterlockedExchange64((volatile __int64 *)v9, (__int64)&LockQueue);
  if( v10 )
    KxWaitForLockOwnerShip((INT64)&LockQueue);
  AccessLog = (_MM_PAGE_ACCESS_INFO_HEADER *)*AgeDistribution;
  if( !*AgeDistribution || (unsigned __int64 *)&AccessLog->PageEntry[1] > AccessLog->FileEntry )
  {
    AccessLog = MiAllocateAccessLog(Vm);
    if( !AccessLog )
      goto LABEL_41;
  }
  LOBYTE(v12) = MI_PFN_IS_PROTO((_UNICODE_STRING *)v8, v10, v7, bf_0);
  if( !v12
    || (v13 = v8->OriginalPte.u.Hard.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0,
        (v13 & 0x400) == 0) )
  {
    v34 = (v4 << 16) | ((unsigned __int64)v6 << 9);
    goto LABEL_36;
  }
  if( *(&stru_140C4DB30 + 42) && (v13 & 0x10) == 0 )
    v13 &= ~*(&stru_140C4DB30 + 42);
  FirstFileEntry = (unsigned __int64)AccessLog->FirstFileEntry;
  v15 = v13 >> 16;
  v16 = (v8->PteLong | 0x8000000000000000ui64) << 16;
  v17 = AccessLog->Process <= (_EPROCESS *)1;
  PteAddress = (_MMPTE *)(v8->PteLong | 0x8000000000000000ui64);
  if( v17 )
  {
    v19 = (*(_BYTE *)(v15 + 34) & 2) == 0;
    v20 = *(_QWORD *)v15;
    v40 = *(_QWORD *)v15;
    if( v19 || (*(_DWORD *)(v20 + 56) & 0x4000000) == 0 )
    {
      v21 = (signed __int64 *)(v20 + 64);
      v22 = (UINT64)ObFastReferenceObject((_EX_FAST_REF *)(v20 + 64));
      if( !v22 )
      {
        v23 = (volatile int *)(v20 + 72);
        v24 = ExAcquireSpinLockShared((INT64 *)(v20 + 72));
        v25 = (_EX_FAST_REF *)(v20 + 64);
        v26 = v24;
        v22 = (UINT64)ObFastReferenceObjectLocked(v25);
        ExReleaseSpinLockSharedFromDpcLevel(v23);
        __writecr8(v26);
        v20 = v40;
      }
      v18 = *(_QWORD *)(v22 + 24);
      _m_prefetchw(v21);
      v27 = *v21;
      if( (v22 ^ *v21) >= 0xF )
      {
LABEL_26:
        ObDereferenceObjectDeferDelete(v22);
      }
      else
      {
        while( 1 )
        {
          v28 = v27;
          v27 = _InterlockedCompareExchange64(v21, v27 + 1, v27);
          if( v28 == v27 )
            break;
          if( (v22 ^ v27) >= 0xF )
            goto LABEL_26;
        }
      }
      LODWORD(v29) = MiStartingOffset((_SUBSECTION *)v15, PteAddress, 0xFFFFFFFFui64);
      v30 = *(_DWORD *)(v20 + 56);
      v6 = v36;
      v31 = v29 << *((_BYTE *)&v38 + 4 * (((unsigned __int64)v30 >> 5) & 1));
      v40 = v31 ^ ((unsigned __int16)v31 ^ (unsigned __int16)(32 * v30)) & 0x400;
      FirstFileEntry -= 8i64;
      v16 = v40;
      goto LABEL_28;
    }
LABEL_41:
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockQueue);
    return;
  }
  v18 = v15;
LABEL_28:
  FileEntry = AccessLog->FileEntry;
  v33 = FileEntry + 1;
  if( (unsigned __int64)(FileEntry + 1) > FirstFileEntry )
    goto LABEL_33;
  while( *v33 != v18 )
  {
    if( (unsigned __int64)++v33 > FirstFileEntry )
      goto LABEL_33;
  }
  if( (unsigned __int64)v33 > FirstFileEntry )
  {
LABEL_33:
    v33 = AccessLog->FileEntry;
    AccessLog->FileEntry = FileEntry - 1;
    *v33 = v18;
  }
  v34 = v16 & 0xFFFFFFFFFFFFFC00ui64 | ((unsigned __int64)v6 << 9) | (AccessLog->FirstFileEntry - v33) & 0x1FF;
LABEL_36:
  *AccessLog->PageFrameEntry = v34;
  ++AccessLog->PageEntry;
  _m_prefetchw(&LockQueue);
  Next = LockQueue.LockQueue.Next;
  if( !LockQueue.LockQueue.Next )
  {
    if( (_KLOCK_QUEUE_HANDLE *)_InterlockedCompareExchange64(
                                  (volatile signed __int64 *)LockQueue.LockQueue.Lock,
                                  0i64,
                                  (signed __int64)&LockQueue) == &LockQueue )
      return;
    Next = KxWaitForLockChainValid(&LockQueue.LockQueue);
  }
  LockQueue.LockQueue.Next = 0i64;
  _InterlockedXor64((volatile signed __int64 *)&Next->Lock, 1ui64);
}

Referenced by: