MiAllocateTopLevelPage

UINT64 __fastcall MiAllocateTopLevelPage(VOID *a1, UINT64 a2){
  unsigned int v4; 
  __int64 v5; 
  _MI_PARTITION *ProcessPartition; 
  unsigned int NextPageColor; 
  UINT64 i; 
  UINT64 v9; 
  UINT64 v10; 
  UINT64 v11; 
  _MMPFN *v12; 
  __int64 v13; 
  unsigned __int64 v14; 
  __int64 v15; 
  __int64 v16; 
  int v17; 
  unsigned __int64 *v18; 
  int v19; 
  _MI_COLOR_BASE ColorBase[10]; 

  *(_OWORD *)ColorBase = 0i64;
  ProcessPartition = MiGetProcessPartition(a1, (_EPROCESS *)a2);
  MiInitializePageColorBase((_MMSUPPORT_INSTANCE *)(v5 + 1664), v4, ColorBase);
  NextPageColor = MiGetNextPageColor((INT64)ColorBase);
  for( i = NextPageColor; ; i = NextPageColor )
  {
    LODWORD(v9) = MiGetPage((ULONG_PTR *)&ProcessPartition->Core.PartitionId, i, 0x302ui64);
    v11 = v9;
    if( v9 != -1i64 )
      break;
    MiWaitForFreePage(ProcessPartition, v10);
  }
  v12 = &MmGetPfnDb()[v9];
  MiSetPfnLink(v12, 0i64);
  LODWORD(v13) = MiMakeValidPte(0i64, v11, 2415919110i64);
  v12->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 = 0i64;
  v12->u4._bf_0 ^= (v11 ^ v12->u4._bf_0) & 0xFFFFFFFFFi64;
  v14 = v13 & 0xFFFFFFFFFFFFFEFFui64;
  MiSetPageTablePfnBuddy((INT64)v12, (INT64)a1, 0i64);
  MiInitializePfnForOtherProcess(v11, MmGetPxeSelfRef(), v11, 0x200ui64);
  LODWORD(v15) = MiMakeValidPte(0i64, v11, 2684354564i64);
  v16 = v15;
  LOBYTE(v17) = MiPteInShadowRange(a2);
  if( v17 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v16 & 1) != 0 )
    v16 |= 0x8000000000000000ui64;
  *(_QWORD *)a2 = v16;
  v18 = (unsigned __int64 *)(((__int64)((a2 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16)
                           + 8 * (((unsigned __int64)MmGetPxeSelfRef() >> 3) & 0x1FF));
  LOBYTE(v19) = MiPteInShadowRange((UINT64)v18);
  if( v19 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v14 & 1) != 0 )
    v14 |= 0x8000000000000000ui64;
  *v18 = v14;
  return v11;
}

Referenced by: