MiGetTopLevelPfn

_MMPFN *__stdcall MiGetTopLevelPfn(_MMPFN *Pfn1, UINT64 *LevelsWalked){
  __int64 bf_0; 
  unsigned int v3; 
  _MMPFN *PfnDb; 
  int v5; 
  __int64 v6; 
  _MMPFN *v7; 
  __int64 v9; 
  __int128 *v10; 
  _MMPFN *v11; 
  UINT64 SpinCount; 
  __int128 v14[2]; 

  bf_0 = Pfn1->u4._bf_0;
  v3 = 0;
  PfnDb = MmGetPfnDb();
  v5 = 0;
  memset(v14, 0, sizeof(v14));
  v6 = bf_0 & 0xFFFFFFFFFi64;
  v7 = Pfn1;
  if( v6 != Pfn1 - PfnDb )
  {
    do
    {
      v9 = v6;
      v7 = &PfnDb[v6];
      if( (unsigned int)++v5 > 4 )
        KeBugCheckEx(0x1Au, (PVOID)0x9696, Pfn1, 0i64, 0i64);
      LODWORD(SpinCount) = 0;
      *((_QWORD *)v14 + (unsigned int)(v5 - 1)) = v7;
      while( _interlockedbittestandset64((volatile signed __int32 *)&v7->u2, 0x3Fui64) )
      {
        do
          KeYieldProcessorEx(&SpinCount);
        while( v7->u2._bf_0 < 0 );
      }
      v6 = v7->u4._bf_0 & 0xFFFFFFFFFi64;
    }
    while( v6 != v9 );
  }
  v10 = v14;
  do
  {
    v11 = *(_MMPFN **)v10;
    if( !*(_QWORD *)v10 )
      break;
    if( v11 != v7 )
      _InterlockedAnd64(&v11->u2.Lock, 0x7FFFFFFFFFFFFFFFui64);
    ++v3;
    v10 = (__int128 *)((char *)v10 + 8);
  }
  while( v3 < 4 );
  return v7;
}

Referenced by: