MiFreeSlabEntries

__int64 __fastcall MiFreeSlabEntries(INT64 a1, INT64 a2, int a3){
  INT64 v4; 
  __int64 v6; 
  UINT64 *v7; 
  unsigned __int8 v8; 
  __int64 v9; 
  unsigned __int64 v10; 
  _QWORD *v11; 
  _QWORD *v12; 
  int v13; 
  UINT64 v14; 
  _QWORD *v15; 
  UINT64 *v16; 
  _MMPFN *v17; 
  volatile int *v18; 
  _MMPFN *v19; 
  __int64 v20; 
  unsigned __int8 CurrentIrql; 
  __int64 v22; 
  int v23; 
  int v24; 
  __int64 v25; 
  _MMPFN *PfnDb; 
  _QWORD *v27; 
  __int64 v28; 
  _MIPFNBLINK *p_u2; 
  unsigned __int64 v30; 
  int v31; 
  int v32; 
  UINT64 SpinCount; 
  unsigned __int64 v35; 

  v4 = a1;
  if( (*(_DWORD *)(a2 + 56) & 1) == 0 )
    return 0i64;
  v6 = 0i64;
  if( !a3 && KiQueryUnbiasedInterruptTime(1u) - *(_QWORD *)(a2 + 104) < 0x2FAF080 )
    return 0i64;
  v35 = 0i64;
  if( !*(_QWORD *)(a2 + 64) )
    goto LABEL_6;
  v17 = 0i64;
  v18 = (volatile int *)(a2 + 16);
  v19 = 0i64;
  v20 = 0i64;
  do
  {
    CurrentIrql = KeGetCurrentIrql();
    __writecr8(2ui64);
    ExAcquireSpinLockSharedAtDpcLevel(v18);
    v22 = *(_QWORD *)a2;
    if( (*(_BYTE *)(a2 + 8) & 1) != 0 )
    {
      if( v22 )
        v22 ^= a2;
      else
        v22 = 0i64;
    }
    v23 = *(_BYTE *)(a2 + 8) & 1;
    while( v22 )
    {
      v24 = MiCompareSlabEntry(&v35, v22);
      if( !v24 )
        goto LABEL_37;
      if( v24 >= 0 )
      {
        v25 = *(_QWORD *)(v22 + 8);
      }
      else
      {
        v25 = *(_QWORD *)v22;
        v6 = v22;
      }
      if( v23 && v25 )
        v22 ^= v25;
      else
        v22 = v25;
    }
    v22 = v6;
LABEL_37:
    v6 = 0i64;
    while( v22 )
    {
      v20 = *(unsigned int *)(v22 + 136);
      if( *(_DWORD *)(v22 + 136)
        && v20 + (unsigned __int64)*(unsigned int *)(v22 + 132) >= 0x200
        && (*(_DWORD *)(v22 + 140) & 1) == 0 )
      {
        PfnDb = MmGetPfnDb();
        v17 = &PfnDb[*(_QWORD *)(v22 + 24)];
        v19 = &PfnDb[*(_QWORD *)(v22 + 32)];
        goto LABEL_50;
      }
      v27 = *(_QWORD **)(v22 + 8);
      v28 = v22;
      if( v27 )
      {
        do
        {
          v22 = (__int64)v27;
          v27 = (_QWORD *)*v27;
        }
        while( v27 );
      }
      else
      {
        while( 1 )
        {
          v22 = *(_QWORD *)(v22 + 16) & 0xFFFFFFFFFFFFFFFCui64;
          if( !v22 || *(_QWORD *)v22 == v28 )
            break;
          v28 = v22;
        }
      }
    }
    PfnDb = MmGetPfnDb();
LABEL_50:
    ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)(a2 + 16));
    if( !v22 )
      break;
    if( !v20 )
      goto LABEL_68;
    p_u2 = &v17->u2;
    while( v17 <= v19 )
    {
      LODWORD(SpinCount) = 0;
      while( _interlockedbittestandset64((volatile signed __int32 *)p_u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( p_u2->_bf_0 < 0 );
      }
      v30 = ((char *)&p_u2[1]._bf_0 + 2 - (char *)(&MmGetPfnDb()->u3 + 1)) / 48;
      if( v30 > 0xFFFFFFFFFi64
        || (MmGetPfnDb()[v30].u4._bf_0 & 0x4000000000000i64) == 0
        || (LOBYTE(v31) = MiIsPfnFromSlabAllocation((INT64)v17), !v31) )
      {
LABEL_65:
        v20 = 0i64;
        goto LABEL_66;
      }
      if( (BYTE2(p_u2[1]._bf_0) & 7) != 2
        || LOWORD(p_u2[1]._bf_0)
        || v17->u1.$976DF529DAC3D73085C9E386D94B91E6::$E228DCF3D8940E384DBC5EFCA756D8B6::_bf_0 >= 0 )
      {
        LOBYTE(v32) = MiIsFreeSlabPage((INT64)v17);
        if( !v32 )
          goto LABEL_65;
      }
      else
      {
        MiUnlinkPageFromList(v17, 0i64);
        MiDiscardTransitionPteEx(v17, 0i64);
        --v20;
      }
LABEL_66:
      _InterlockedAnd64(&p_u2->Lock, 0x7FFFFFFFFFFFFFFFui64);
      ++v17;
      p_u2 += 6;
      if( !v20 )
        break;
    }
    PfnDb = MmGetPfnDb();
LABEL_68:
    v35 = ((__int64)((unsigned __int128)(((char *)v19 - (char *)PfnDb) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 3)
        + ((unsigned __int64)((unsigned __int128)(((char *)v19 - (char *)PfnDb) * (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 63)
        + 1;
    __writecr8(CurrentIrql);
    v18 = (volatile int *)(a2 + 16);
    CurrentIrql = 17;
  }
  while( *(_QWORD *)(a2 + 64) );
  if( CurrentIrql != 17 )
    __writecr8(CurrentIrql);
  v4 = a1;
LABEL_6:
  v7 = 0i64;
  v8 = ExAcquireSpinLockExclusive((INT64 *)(a2 + 16));
  *(_DWORD *)(a2 + 56) &= ~1u;
  v9 = *(_QWORD *)(a2 + 8);
  v10 = v8;
  if( (v9 & 1) != 0 )
  {
    if( v9 != 1 )
    {
      v11 = (_QWORD *)(v9 ^ (a2 | 1));
      goto LABEL_13;
    }
  }
  else
  {
    v11 = *(_QWORD **)(a2 + 8);
LABEL_13:
    while( v11 )
    {
      v12 = (_QWORD *)v11[1];
      v14 = (UINT64)v11;
      v15 = v11;
      if( v12 )
      {
        do
        {
          v11 = v12;
          v12 = (_QWORD *)*v12;
        }
        while( v12 );
      }
      else
      {
        while( 1 )
        {
          v11 = (_QWORD *)(v11[2] & 0xFFFFFFFFFFFFFFFCui64);
          if( !v11 || (_QWORD *)*v11 == v15 )
            break;
          v15 = v11;
        }
      }
      if( (*(_DWORD *)(v14 + 140) & 1) == 0 )
      {
        v13 = *(_DWORD *)(v14 + 132);
        if( v13 == 512 )
        {
          MiRemoveSlabEntry(v4, (UINT64 *)a2, v14);
          *(_QWORD *)v14 = v7;
          v7 = (UINT64 *)v14;
        }
        else if( (unsigned int)(v13 + *(_DWORD *)(v14 + 136)) >= 0x200 )
        {
          *(_DWORD *)(a2 + 56) |= 1u;
        }
      }
    }
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)(a2 + 16));
  __writecr8(v10);
  while( 1 )
  {
    v16 = v7;
    if( !v7 )
      break;
    v7 = (UINT64 *)*v7;
    MiFreeSlabEntry(a2, v16);
  }
  return 0i64;
}

Referenced by: