MiReferenceIoPages

__int64 __fastcall MiReferenceIoPages(
        unsigned int a1,
        __int64 a2,
        INT64 a3,
        int a4,
        _DWORD *a5,
        _RTL_BALANCED_NODE **a6){
  __int64 v8; 
  unsigned __int64 v9; 
  _RTL_BALANCED_NODE **v10; 
  char *v11; 
  unsigned __int64 v12; 
  __int64 v13; 
  char *v14; 
  unsigned __int8 CurrentIrql; 
  _RTL_BALANCED_NODE *v16; 
  INT64 v17; 
  BOOL v18; 
  _RTL_BALANCED_NODE *v19; 
  _RTL_BALANCED_NODE *v20; 
  _RTL_BALANCED_NODE *Pool; 
  unsigned __int64 v22; 
  UINT64 v23; 
  _RTL_BALANCED_NODE *v24; 
  unsigned __int16 *v25; 
  __int64 v26; 
  UINT64 v27; 
  int v28; 
  unsigned __int16 v29; 
  signed int v30; 
  unsigned __int64 ParentValue; 
  _RTL_BALANCED_NODE *v33; 
  NTSTATUS v34; 
  int v35; 
  _RTL_BALANCED_NODE *v36; 
  signed __int64 v37; 
  _MDL *v38; 
  int v39; 
  unsigned int v42; 
  INT64 v43; 
  unsigned __int64 v44; 
  _RTL_BALANCED_NODE **Tree; 
  _RTL_BALANCED_NODE **v46; 
  unsigned __int8 v47; 
  char v48[176]; 

  v8 = (int)a1;
  v43 = a3;
  memset(v48, 0i64, sizeof(v48));
  if( a5 )
    *a5 = 0;
  if( a6 )
    *a6 = 0i64;
  v42 = 0;
  v39 = 0;
  v9 = a2 & 0xFFFFFFFFFi64;
  v44 = v9;
  Tree = (_RTL_BALANCED_NODE **)((char *)&stru_140C4DB30 + 8 * v8 + 3672);
  v10 = (_RTL_BALANCED_NODE **)((char *)&stru_140C4DB30 + 3688);
  v11 = 0i64;
  v12 = v9;
  if( (_DWORD)v8 != 1 )
    v10 = 0i64;
  v13 = -1i64;
  v46 = v10;
  v14 = 0i64;
  CurrentIrql = KeGetCurrentIrql();
  v47 = CurrentIrql;
  __writecr8(2ui64);
  if( a1 == 1 )
  {
    v16 = MiIoSpaceIsConstant(v9, a3);
    if( v16 )
      a4 = *(_DWORD *)&v16[1]._bf_0;
  }
  ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)&stru_140C4DB30 + 458);
  v17 = a3;
  if( a3 )
  {
    while( 1 )
    {
      v18 = 0;
      v19 = *Tree;
      if( *Tree )
      {
        while( 1 )
        {
          ParentValue = v19[1].ParentValue;
          if( v9 < ParentValue )
          {
            v33 = v19->Children[0];
            if( !v19->Children[0] )
              break;
          }
          else
          {
            if( v9 < ParentValue + 512 )
            {
              v20 = v19;
              goto LABEL_18;
            }
            v33 = v19->Children[1];
            if( !v33 )
            {
              v18 = 1;
              break;
            }
          }
          v19 = v33;
        }
      }
      if( !v46 || (v20 = MiRemoveUnmappedIoNode(v46, v9)) == 0i64 )
      {
        Pool = (_RTL_BALANCED_NODE *)MiAllocatePool(64i64, 0x440ui64, 0x6F49694Dui64);
        v20 = Pool;
        if( !Pool )
        {
          ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&stru_140C4DB30 + 458);
          __writecr8(CurrentIrql);
          MiDereferenceIoPages(a1, v44, v9 - v44);
          return 3221225626i64;
        }
        Pool[1].ParentValue = v9 & 0xFFFFFFFFFFFFFE00ui64;
        Pool[2].Children[0] = (_RTL_BALANCED_NODE *)((char *)Pool + 64);
        MiInitializeIoPageNodeArray((_MI_IO_PFN_NODE *)Pool);
      }
      RtlAvlInsertNodeEx(Tree, (UINT64)v19, v18, v20);
      v17 = v43;
LABEL_18:
      if( a6 && !*a6 )
        *a6 = v20;
      v22 = v20[1].ParentValue;
      v23 = (UINT64)v20[2].Children[0];
      v24 = (_RTL_BALANCED_NODE *)(v22 + 512);
      v25 = (unsigned __int16 *)(v23 + 2 * (v9 - v22));
      if( v22 == -512i64 || v17 + v9 <= (unsigned __int64)v24 )
        v26 = 2 * (v17 + v9 - v22);
      else
        v26 = 1024i64;
      v27 = v26 + v23;
      if( (unsigned __int64)v25 < v26 + v23 )
        break;
LABEL_33:
      if( v39 )
      {
        v36 = v20[2].Children[0];
        v24 = (_RTL_BALANCED_NODE *)((char *)v36 + 1024);
        if( v36 < (_RTL_BALANCED_NODE *)&v36[42].16 )
        {
          v23 = 0x3FFFi64;
          do
          {
            if( ((__int64)v36->Children[0] & 0x3FFF) == 0 )
              LOWORD(v36->Children[0]) |= 0xC000u;
            v36 = (_RTL_BALANCED_NODE *)((char *)v36 + 2);
          }
          while( v36 < v24 );
          CurrentIrql = v47;
          v17 = v43;
        }
      }
      if( !v17 )
      {
        v12 = v44;
        goto LABEL_36;
      }
    }
    v23 = (UINT64)a5;
    v28 = v39;
    while( 1 )
    {
      v29 = *v25;
      LODWORD(v24) = *v25;
      if( (*v25 & 0x3FFF) == 0x3FFF )
        break;
      v30 = (unsigned int)v24 >> 14;
      if( (v29 & 0x3FFF) != 0 )
      {
        if( v30 == a4 )
          ++*(&stru_140C4DB30 + 932);
        else
          ++*(&stru_140C4DB30 + 933);
      }
      else
      {
        ++v20[2].Children[1];
        if( v30 == a4 )
        {
          ++*(&stru_140C4DB30 + 935);
        }
        else
        {
          if( v46 && (v29 & 0xC000) == 0x4000 && !v28 )
          {
            ++*(&stru_140C4DB30 + 936);
            if( !v11 )
            {
              v11 = v48;
              v14 = &v48[48];
            }
            *(_QWORD *)v14 = v9;
            v14 += 8;
            if( v14 == v11 + 176 )
            {
              ++*(&stru_140C4DB30 + 934);
              *(_QWORD *)v11 = 0i64;
              *((_DWORD *)v11 + 2) = 131248;
              *((_QWORD *)v11 + 4) = 0i64;
              *((_QWORD *)v11 + 5) = 0x10000i64;
              v34 = MiFlushCacheMdl((_MDL *)1, (_MI_PFN_CACHE_ATTRIBUTE)v30, v23);
              v35 = v39;
              v17 = v43;
              v11 = 0i64;
              if( v34 )
                v35 = 1;
              v39 = v35;
              v28 = v35;
            }
          }
          v23 = (UINT64)a5;
          v29 = (_WORD)a4 << 14;
        }
      }
      if( v23 )
        *(_DWORD *)v23 |= 1 << (v29 >> 14);
      LODWORD(v24) = 1;
      --v17;
      ++v9;
      v43 = v17;
      *v25++ = (v29 ^ (v29 + 1)) & 0x3FFF ^ v29;
      if( (unsigned __int64)v25 >= v27 )
        goto LABEL_33;
    }
    v12 = v44;
    v42 = -1073741670;
    if( v9 != v44 )
      v13 = v9;
LABEL_36:
    if( v11 )
    {
      ++*(&stru_140C4DB30 + 934);
      v37 = v14 - v11;
      *(_QWORD *)v11 = 0i64;
      *((_QWORD *)v11 + 4) = 0i64;
      *((_DWORD *)v11 + 11) = 0;
      *((_WORD *)v11 + 5) = 2;
      v38 = (_MDL *)((unsigned __int64)(unsigned int)((v37 - 48) >> 3) << 12);
      *((_DWORD *)v11 + 10) = (_DWORD)v38;
      *((_WORD *)v11 + 4) = 8 * (((v37 - 48) >> 3) + 6);
      MiFlushCacheMdl(v38, (_MI_PFN_CACHE_ATTRIBUTE)v24, v23);
    }
  }
  ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&stru_140C4DB30 + 458);
  __writecr8(CurrentIrql);
  if( v13 != -1 )
    MiDereferenceIoPages(a1, v12, v13 - v12);
  return v42;
}

Referenced by: