MiUpdateImagePfnImportRelocations

NTSTATUS __stdcall MiUpdateImagePfnImportRelocations(INT64 a1, UINT64 a2, UINT64 a3, INT64 a4){
  UINT64 v4; 
  unsigned int v5; 
  _EX_PUSH_LOCK *v7; 
  __int64 bf_0; 
  _WORD *v9; 
  _MMPFN *v10; 
  _MMPTE *PteBase; 
  UINT64 v12; 
  UINT64 v13; 
  int v14; 
  __int64 v15; 
  __int64 v16; 
  int v17; 
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *v19; 
  _KTBFLUSH_TYPE v20; 
  unsigned __int64 Long; 
  int v23; 

  v4 = a2;
  v5 = a3;
  v7 = *(_EX_PUSH_LOCK **)(*(_QWORD *)(a1 + 96) + 32i64);
  bf_0 = v7[12]._bf_0;
  if( !bf_0 )
    return 1;
  v9 = *(_WORD **)(bf_0 + 8i64 * (unsigned int)a3 + 56);
  if( !v9 || !*v9 && v9[3] != 3 )
    return 1;
  v10 = &MmGetPfnDb()[a4];
  PteBase = MmGetPteBase();
  if( a2 && (a2 < (unsigned __int64)PteBase || a2 > (unsigned __int64)MmGetPteLimit()) )
  {
    v13 = 0i64;
    v12 = 0i64;
  }
  else
  {
    v12 = a2;
    v13 = (UINT64)MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), 1ui64);
    if( !v13 )
    {
      if( !v4 )
        return -1073741670;
      v13 = v4;
    }
    v4 = (__int64)((v13 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16;
    MiMakeProtectionPfnCompatible((_BYTE *)4, v10);
    LODWORD(v15) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v13, a4, v14 | 0xA0000000);
    v16 = v15;
    LOBYTE(v17) = MiPteInShadowRange(v13);
    if( v17 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v16 & 1) != 0 )
      v16 |= 0x8000000000000000ui64;
    *(_QWORD *)v13 = v16;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v19 = v7 + 3;
  if( (_ETHREAD *)v7[1]._bf_0 == CurrentThread )
  {
    CurrentThread = 0i64;
  }
  else
  {
    --CurrentThread->Tcb.SpecialApcDisable;
    ExAcquirePushLockSharedEx(v7 + 3, 0i64);
  }
  MiUpdateRetpolineImportFixups(v4, v7[12]._bf_0, v5);
  if( CurrentThread )
  {
    if( _InterlockedCompareExchange64(&v19->_bf_0, 0i64, 17i64) != 17 )
      ExfReleasePushLockShared(v19);
    KeAbPostRelease(v19);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  if( v13 )
  {
    if( v13 == v12 )
    {
      Long = ZeroPte.u.Long;
      LOBYTE(v23) = MiPteInShadowRange(v13);
      if( v23 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (ZeroPte.u.Long & 1) != 0 )
        Long = ZeroPte.u.Long | 0x8000000000000000ui64;
      *(_QWORD *)v13 = Long;
      KeFlushSingleTb(v4, FlushKernel, 1i64);
    }
    else
    {
      MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), (_MMPTE *)v13, 1ui64, v20);
    }
  }
  return 0;
}

Referenced by: