MiLeapPrefetch

NTSTATUS __stdcall MiLeapPrefetch(_MI_FAULT_VA_LIST *PrefetchHead, VOID *Va){
  VOID *v2; 
  NTSTATUS v4; 
  unsigned __int64 v5; 
  _ETHREAD *CurrentThread; 
  char bf_0; 
  _EPROCESS *Process; 
  unsigned __int64 Root; 
  char v10; 
  char v11; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  unsigned __int64 v14; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  _QWORD *v19; 
  unsigned __int64 v20; 
  _QWORD **v21; 
  unsigned __int64 v22; 
  _QWORD *v23; 

  v2 = Va;
  v4 = 1;
  if( Va )
  {
LABEL_20:
    v18 = *((_QWORD *)PrefetchHead + 3);
    v19 = (_QWORD *)(*((_QWORD *)PrefetchHead + 1) + 16 * v18);
    v20 = *v19 & 0xFFFFFFFFFFFFF000ui64;
    if( (unsigned __int64)v2 >= v20
      && (unsigned __int64)v2 < v20 + (((*(_DWORD *)v19 & 0xFFF) + v19[1] + 4095i64) & 0xFFFFFFFFFFFFF000ui64) )
    {
      *((_QWORD *)PrefetchHead + 4) = ((unsigned __int64)v2 - v20) >> 12;
      return v4;
    }
    goto LABEL_22;
  }
  v5 = *(_QWORD *)(*((_QWORD *)PrefetchHead + 1) + 16i64 * *((_QWORD *)PrefetchHead + 3))
     + (*((_QWORD *)PrefetchHead + 4) << 12);
  if( v5 <= 0x7FFFFFFEFFFFi64 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    bf_0 = CurrentThread->$84F33738BEE95ACDF5C5BF1C8FDC7C8C::_bf_0;
    if( bf_0 >= 0 && ((unsigned __int8)~((unsigned __int8)CurrentThread->_bf_1 >> 6) & ((bf_0 & 3) == 0)) != 0 )
    {
      Process = CurrentThread->Tcb.ApcState.Process;
      MiLockWorkingSetShared();
      v11 = v10;
      if( (Process->Flags & 0x20) == 0 && Process->VadCount )
      {
        Root = (unsigned __int64)Process->VadRoot.Root;
        v12 = v5 >> 12;
        while( Root )
        {
          v13 = *(unsigned int *)(Root + 24) | ((unsigned __int64)*(unsigned __int8 *)(Root + 32) << 32);
          if( v12 >= v13 )
          {
            if( v12 <= (*(unsigned int *)(Root + 28) | ((unsigned __int64)*(unsigned __int8 *)(Root + 33) << 32)) )
              goto LABEL_16;
            v14 = *(_QWORD *)(Root + 8);
          }
          else
          {
            v14 = *(_QWORD *)Root;
          }
          if( !v14 )
          {
            if( v13 >= v12 )
              goto LABEL_19;
            v21 = *(_QWORD ***)(Root + 8);
            v22 = Root;
            if( v21 )
            {
              v23 = *v21;
              for( Root = *(_QWORD *)(Root + 8); v23; v23 = (_QWORD *)*v23 )
                Root = (unsigned __int64)v23;
            }
            else
            {
              while( 1 )
              {
                Root = *(_QWORD *)(Root + 16) & 0xFFFFFFFFFFFFFFFCui64;
                if( !Root || *(_QWORD *)Root == v22 )
                  break;
                v22 = Root;
              }
            }
            if( Root )
            {
LABEL_19:
              v16 = *(unsigned __int8 *)(Root + 32);
              v17 = *(unsigned int *)(Root + 24);
              LOBYTE(Root) = v11;
              v2 = (VOID *)((v17 | (v16 << 32)) << 12);
              MiUnlockWorkingSetShared(&Process->Vm.Instance, Root);
              goto LABEL_20;
            }
            break;
          }
          Root = v14;
        }
        LOBYTE(Root) = v11;
        MiUnlockWorkingSetShared(&Process->Vm.Instance, Root);
        v18 = *((_QWORD *)PrefetchHead + 3);
LABEL_22:
        *((_QWORD *)PrefetchHead + 4) = 0i64;
        *((_QWORD *)PrefetchHead + 3) = v18 + 1;
        return v4;
      }
      v4 = 0;
LABEL_16:
      LOBYTE(Root) = v11;
      MiUnlockWorkingSetShared(&Process->Vm.Instance, Root);
    }
  }
  return v4;
}

Referenced by: